Add the signature v1 convenience signer

[jt55401]

Summary

• replace the legacy colon-binding convenience signer with the frozen RFC 8785 v1 payload
• derive HTTPS URL or origin location and recompute strict claims
• choose the newest active directory-held key deterministically
• keep signed artifacts immutable with idempotent retries and explicit conflicts
• return the complete signed-section attribute set and document the API
• pin canonicalization v0.3.0 at b0c8f305

Validation

• clean npm ci
• npm test (85 passing)
• npm run openapi:lint
• npm run conformance (12 fixtures and 12 v1 smoke checks)
• git diff --check