Assess deferred sodium initialization fallback during module import

[MariusStorhaug]

PR #45 intentionally initializes Sodium during module import for deterministic startup and cached constants, but review feedback raised a valid usability trade-off: failing native initialization during import prevents module discovery/help workflows on unsupported hosts.

This follow-up should evaluate whether import-time fail-fast should remain the default or whether deferred init at first public command invocation provides a better user experience without sacrificing validation and diagnostics.

Context:

• Triggered by review threads: r3254536253 and r3254569601
• Related comment consistency thread: r3254554837 / r3254586259
• PR reference: 🩹 [Patch]: Secret crypto operations now fail fast on invalid input with lower per-call overhead #45