Sign a single outbound request. The body stays plaintext; the impl
returns the headers the caller must merge onto the outbound
reqwest::RequestBuilder.
Accessor used by every caller. Returns UnavailableSigner in the
open-source build; with codingplan-crypto on, returns RealSigner
which forwards into the closed-source atomcode-codingplan-crypto
crate.