Function generate_restore_code 

pub fn generate_restore_code(
    config: &Config,
    key_service: &StoreKeys,
    custody: &dyn MasterKeyCustody,
    store_root: StoreRootRef,
    founder_pubkey: String,
    membership_floor: MembershipFloor,
    authority: RestoreAuthority,
) -> Result<String, SetupError>

Build a RestoreCode from config and custody, then encode it.

membership_floor is the exact policy-shaped membership state at mint time. The caller fetches it because this function never touches the network.