Sign decision envelopes and close FLEX-WP-0024.

Detached Ed25519 over the canonical envelope with signature omitted.
Unsigned is stated, not implied. Testdata fixtures prove verify and
tamper failure without minting a production key. FLEX-WP-0025 is
finished with the validate check from the previous commit.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

internal/decision/engine.go

@@ -382,6 +382,9 @@ func (e *Engine) envelope(ctx context.Context, request, submitted api.CheckReque
 		Now:      e.now(),
 	})
 	envelope.ID = decisionID(e.policy.Metadata, request, envelope)
+	if envelope.Signature == nil {
+		envelope.Signature = api.UnsignedEnvelopeSignature()
+	}
 	return envelope
 }
 

internal/decision/engine_test.go

@@ -72,6 +72,9 @@ func TestCheckUsesExplicitCaringContext(t *testing.T) {
 	if got.Provenance.Caller == nil || got.Provenance.Caller.Mode != "disabled" || got.Provenance.Caller.Principal != "" {
 		t.Errorf("got.Provenance.Caller = %+v; want disabled with no principal", got.Provenance.Caller)
 	}
+	if got.Signature == nil || got.Signature.Mode != api.EnvelopeSignatureUnsigned {
+		t.Errorf("got.Signature = %+v; want unsigned", got.Signature)
+	}
 }
 
 func TestCallerProvenanceDoesNotChangeRequestDigest(t *testing.T) {