Provenance signatures for polychrome.
Wraps commonware-cryptography ed25519 so the harness can sign the bytes
that back a tool call's signature field and the control plane can verify
them. A fixed [NAMESPACE] provides cross-domain separation (a signature
minted here cannot be replayed in another context).
This primitive is runtime-agnostic — it does not pull in commonware-runtime
or commonware-p2p.