Because:
- `pkR` is stored in the clear and HPKE `mode_base` authenticates nothing
a PRF holder can check, so anyone holding the `passkeyWraps` row could
`Seal` a kB of their choosing to `pkR` and the genuine `skR` would open
it; the client has no reference kB to compare against.
- The only layer keyed by a secret the row holder lacks is the AES-GCM
wrap of `skR` under HKDF(prfOut), so its aad must cover the HPKE fields.
- Regenerating the v1 fixture is the README's option 3 and assumes
`passkeyWraps` is empty in stage and prod; `check:frozen` refuses the
fixture, hence `--no-verify`.
This commit:
- Seals first, then wraps `skR` under `context || frame(pkR, enc, ct)`;
`openWrapEnvelope` rebuilds the same aad before unwrapping.
- Adds a resealed-kB rejection test; corrupted HPKE fields now fail at the
AES layer.
- Regenerates the golden vectors with a throwaway script importing only
`hpke` and `crypto.subtle`, and re-pins `FIXTURE_SHA256`.
- Updates the README's regeneration recipe for the new aad.
Fixes FXA-14742