Enforce signed directory writes and protocol metadata

[jt55401]

Summary

• require authenticated signed writes and bounded key resolution
• expand directory protocol conformance and publish complete signing key metadata
• use configured public directory URLs
• install canonicalization v0.2.2 from an integrity-pinned HTTPS tarball
• preserve duplicate claim rejection when accepting array input

Validation

• fresh Node 22 container install
• 34 unit tests passed
• 12 of 12 API conformance fixtures passed
• dependency install required no GitHub SSH credentials