fix(security)!: enforce trusted runtime boundaries

[skhaz]

Summary

• Require authenticated internode handshakes with HMAC and Ed25519 trust pinning.
• Sign and audience-bind Temporal security claims with replay-safe IDs and key rotation.
• Enforce WASM function authorization, .wapp digest verification, and HTTP redirect, dial, peer, and Unix-socket authorization.
• Enable strict security mode by default.

Setup

• Configure cluster.internode.identity_key or identity_key_file and trusted_peer_keys on every cluster node before a coordinated rollout; legacy peers are incompatible.
• Configure a 32-byte or longer security_hmac_key for Temporal client resources and retain security_hmac_previous_keys during rotation.
• Drain in-flight workflows carrying unsigned wippy-security headers before rollout.

Testing

• make lint
• make test with the race detector on macOS/arm64, Linux/arm64, and Linux/amd64 using Go 1.26.4
• Windows/amd64 all-package compilation and focused tests under Wine; native Windows remains covered by CI
• Independent adversarial review found no remaining HIGH or MEDIUM issues

Notes

• Unpacked modules are regenerated from verified archives at startup. A synthetic 100-entry module measured approximately 4.7 ms and 5 MB per initialization versus 3.7 µs and 1.1 KB previously.