Implement initial ArborKDF CLI

[SeriousPassenger]

Summary

• implement the CLI-only ArborKDF command tree for deterministic subkeys, master-key generation, salt generation, strict encoding, and built-in wordlist management
• require explicit PBKDF2-HMAC-SHA3-512 iterations, Argon2id v1.3 memory/iterations/parallelism, input encoding, output encoding, public salt, and virtual path
• bind the public salt and validated path with versioned, length-delimited framing, then derive through KMAC256 or SP 800-108 HMAC-SHA3-512 according to the selected symmetric post-quantum margin
• combine OS CSPRNG output with a domain-separated SHAKE256 mouse stream while reporting Shannon, MCV, Rényi-2, Markov, and compression diagnostics separately
• retain arbitrary custom wordlists and embed both embedded_bip39 and the new embedded_en_tr_jp_131072 selector
• add arborkdf wordlist list and exact, exclusive-create arborkdf wordlist export
• preserve strict lossless hex, Base64, and wordlist output: incompatible sizes fail without padding, truncation, or discarded bits
• use Make-only C++17 builds with warnings as errors and Linux/macOS/Windows CI

Embedded English–Turkish–Japanese list

• exactly 131,072 entries (2^17), so each uniformly sampled word carries 17 ideal bits
• fixed quotas: 43,691 English, 43,691 Turkish, and 43,690 ASCII Japanese roman-input entries
• English candidates combine pinned Debian US and GB SCOWL packages; Turkish uses pinned hunspell-tr; Japanese readings use pinned NAIST JDIC data and pinned jaconv conversion behavior
• cross-language duplicates are removed before deterministic, domain-separated SHA3-512 selection and ordering
• source artifacts, versions, hashes, licenses, selection rules, quotas, membership counts, and golden indices are recorded in the committed manifest and notices
• canonical LF-terminated text SHA-512:
  e59905f19627e0f98e72887187463f9a0767592612ec337a8ff5e71e373f96d7e5b5c4066427ceb89a8acbb13bd5092327e92f7802b0afc2e64ee83e58780c8a
• the canonical text and generated C++ embedding are offered as complete composite files under MPL-2.0; upstream notices and licenses remain applicable
• builds verify the canonical bytes, manifest, invariants, golden indices, and generated header before compilation; built-in runtime use performs no file access or integrity hashing
• deterministic clean-room rebuilds reproduced the canonical text and manifest exactly under varied timezone and Python hash-seed settings

Encoding and entropy consequences

• 8, 16, and 31 independently generated words represent 136, 272, and 527 ideal source bits
• byte encoding with the 17-bit fixed-width codec is lossless only every 136 bits; tested successes include 136, 272, and 544 bits, while 128, 256, and 512 bits fail with exact remainder and nearest-compatible guidance
• a larger codebook reduces word count only for independent uniform machine selection; it does not increase the entropy of human-chosen phrases
• the list intentionally has no mnemonic checksum and is substantially harder to memorize, pronounce, audit, and transcribe than BIP-39 English
• generic quantum search is accounted for by explicit security ceilings; output length and extra words do not manufacture source entropy

Validation

• GCC 13 warnings-as-errors build and the full unit/integration/KDF-vector suite pass locally
• ASan/UBSan pass locally
• generator mutation, stale-header, exact-catalog, exact-export, no-overwrite, Unicode-path, symlink/directory refusal, and strict codec tests pass
• independent implementation, provenance/license, and cross-platform reviews completed; review corrections were incorporated
• GitHub commit 89fba4e769b846c83edebe464c71a9326f37559a has tree 9414fb749023b21d3d4976dffa12c6e6276f5903, exactly matching the local committed tree
• Windows CI exposed MSYS2 deep-copy symlink emulation; the test now distinguishes native links, requires native dangling-link coverage in Windows CI, and the exporter opens the final component with reparse-point no-follow semantics
• CI run 18 is green on Linux, macOS, and Windows; Windows requires and exercises a genuine native dangling symlink, and Linux executes the full static test suite

Review cautions

This remains an unaudited experimental pre-release. Passing tests establishes build and regression coverage, not cryptographic review, entropy-source certification, post-quantum certification, side-channel certification, vocabulary suitability, or fitness for production secrets.

A lone statically linked executable is not a complete redistributable package for this composite wordlist. Distributors must retain the applicable notices and license terms and make corresponding source available where required.