v1.7.1 — diceware snippet fix

A documentation fix. No script, no on-disk behaviour, and nothing in the
encryption path changed — if you are already running v1.7.0 there is nothing
here you need to re-run.

Fixed

The diceware passphrase recipe in the README did not work, and overstated its
own entropy.

The snippet carried the EFF wordlist URL as a comment and then went straight to
shuf, with no step that actually downloads the file. Anyone who had not
already fetched eff_large_wordlist.txt by hand got:

shuf: eff_large_wordlist.txt: No such file or directory

The second problem was quieter. The command used shuf -n 8, which samples
without replacement, while the paragraph directly above it computes strength
from log2(7776) = 12.92 bits per word. That figure describes independent
draws. Sampling without replacement is a different model, and it cannot produce
the repeated word that a genuine sequence of dice rolls sometimes should.

The recipe now fetches the list, verifies it against a published SHA-256, and
draws with shuf -r:

# EFF long wordlist: 7,776 lines of "11111<TAB>abacus"
curl -O https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt

# Verify it before trusting it for entropy
echo 'addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e  eff_large_wordlist.txt' \
    | sha256sum -c

# Eight words, drawn with replacement, from the kernel CSPRNG
shuf -r -n 8 --random-source=/dev/urandom eff_large_wordlist.txt | cut -f2 | paste -sd' '

The checksum is not ceremony. A truncated or substituted wordlist lowers your
entropy silently — the passphrase still reads as eight ordinary English words.
A list cut to its first 100 lines yields 53 bits instead of 103, and nothing in
the output tells you that happened.

Full changelog: v1.7.0...v1.7.1