pub(crate) fn pin_salt(chip_serial: &[u8; 9]) -> [u8; 32]
Compute the PIN salt deterministically from the chip serial number.
The serial is the 9-byte ATECC unique ID read from the config zone.