Orgchain v1.2: tapkeys and lineage's leaves

A node's chain key is now its tapkey: its NIP-06 npub with the BIP-86
tweak, so one secret signs its nostr events and its chain spends, and
its address follows from its npub. Its leaves hang off the same tree,
byte for byte as on lineage's key tree page: an agent's ssh, git, dkim
and wg keys from its nostr secret, an org's ssh-ca, mtls and noise keys
from its seed. Inspect shows the tapkey, npub, derivation and leaves,
with the public lines to paste. Labs keyed by v1.1 keep their separate
m/86' chain keys until they are reset.

PROVENANCE.md and public/licenses now carry @scure/base, bip32 and
bip39, which came in with v1.1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4upF5LVwmPDDqrhdUfnXh

README.md

@@ -16,10 +16,14 @@ chain itself records who did what, and when.
   anything is signed. Events it rejects stay on the chain and show as rejected; they just don't change the tree.
 - **Keys.** Each holding gets its own 24-word lab root, and every node has lineage's keys at its place in the tree
   (`src/orgchain/keys.js`): an org's seed is BIP-85 from its parent's, or its own root once it graduates; agents are
-  accounts 1..n of their org's seed; each key is BIP-86 (the wallet that holds the node's inscription and signs for it)
-  and NIP-06 (its npub). Every act is signed by whichever key holds the authorizing inscription, and a birth hands the
-  child its own. Graduation is a claim by the org's fresh root, countersigned by its derived key, and the derived
-  subtree re-keys under the new root, so the parent's line can no longer sign for it.
+  accounts 1..n of their org's seed. A node's **tapkey** is its NIP-06 npub with the BIP-86 tweak: one secret signs its
+  nostr events and its chain spends, and anyone with the npub can find what it holds. Its **leaves** hang off the same
+  tree, byte for byte as on lineage's key tree page (`src/orgchain/leaves.js`): an agent's ssh, git, dkim and wg keys
+  from its nostr secret, an org's ssh-ca, mtls and noise keys from its seed, each with the public line to paste. Every
+  act is signed by the tapkey that holds the authorizing inscription, and a birth hands the child its own. Graduation is
+  a claim by the org's fresh root, countersigned by its derived key, and the derived subtree re-keys under the new
+  root, so the parent's line can no longer sign for it. Labs keyed by v1.1 keep their separate m/86' chain keys until
+  they are reset.
 
 Test coins and test keys only: a local chain, the lab wallet (the faucet that funds every key) and each holding's lab
 root, kept in this browser (`localStorage`, key `orgchain:lab:v1`). Nothing here is a real key; minting a real root is