Enforce Ed25519 key type and canonical bytes for execution receipts

[aruintelligence]

Change

• Refuse RSA and EC private keys in signExecutionReceipt and refuse non-Ed25519 public keys in verifySignedExecutionReceipt, including legacy receipt signatures.
• Require exactly 64 signature bytes in canonical base64. Node's permissive decoder previously ignored appended garbage and accepted alternate spellings of the same signature.
• Exercise signing, verification, the host render callback, and the Python capsule verifier with mislabeled RSA/EC signatures and altered base64.

Reproduction

Before this patch, crypto.sign(null, ...) and crypto.verify(null, ...) accepted RSA and EC keys while the receipt declared algorithm: "Ed25519". If a host pinned the RSA/EC fingerprint, applyLockedHttpDecision entered its render callback. An otherwise valid Ed25519 receipt with !!!! appended to its base64 signature also reached the callback. After the change both paths block before rendering. This does not claim a bypass of a correctly pinned Ed25519 key.

Checks

• node --test: 801 passed
• Python capsule cross-runtime corpus: 39 passed
• Locked HTTP Python exchange: 28 passed
• Both enterprise HTTP pilots, archive/migration/shard/recovery checks, API stability, upgrade contract, and Markdown links passed

All examples are project-authored; they do not prove independent validation or production deployment fitness.