Harden entropy fail-closed behavior

[shadowbipnode]

Summary

• require the mandatory OS CSPRNG source when deriving mnemonics
• fail if OS entropy returns an unexpected byte count
• lazy-load qrcode so self-test/help work on minimal offline environments
• document fail-closed entropy handling and add regression tests

Verification

• python3 -m compileall -q entropyseed tests seedgen.py seed.py
• python3 seedgen.py --self-test
• python3 seedgen.py --help
• direct check that derive_mnemonic rejects source lists without os-csprng

Note: full pytest could not be run locally because this VM lacks pip/pytest/python3-venv; GitHub Actions should run the complete matrix.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 73ee995fb4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Check QR support before generating the mnemonic

When qrcode is absent and the user requests --qr—the minimal offline environment this change is intended to support—the import now occurs only after main() has generated and printed the mnemonic. It then raises an uncaught ModuleNotFoundError, leaving the user with an unnecessarily exposed mnemonic but no requested QR output. Resolve/import the optional dependency immediately after parsing --qr, before entropy collection and mnemonic generation, and report a controlled error if unavailable.

Useful? React with 👍 / 👎.

[shadowbipnode]

Addressed the Codex QR review feedback in commit 0b3bdc1. When --qr is requested, the CLI now checks for the optional qrcode dependency immediately after argument parsing and exits with a controlled error before entropy collection or mnemonic generation if QR support is unavailable. Added regression coverage for that path.