The instance() call you refer to does this:
return (PasswordHash) Component.getInstance(PasswordHash.class, ScopeType.STATELESS);
which means that your component should be found rather than the built in implementation, because it inherits from PasswordHash, and because it overrides the existing implementation by having a higher precedence.
Also, FWIW, the default precedence for a seam component is APPLICATION, so you can drop the @Install declaration.
I should've looked one method deeper...