encodeSecretKey

Consume a temporary secret copy and return its canonical nsec.

Call this only inside Android's authenticated export flow.