Sign decision envelopes and close FLEX-WP-0024.

Detached Ed25519 over the canonical envelope with signature omitted.
Unsigned is stated, not implied. Testdata fixtures prove verify and
tamper failure without minting a production key. FLEX-WP-0025 is
finished with the validate check from the previous commit.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

internal/decision/engine.go

@@ -382,6 +382,9 @@ func (e *Engine) envelope(ctx context.Context, request, submitted api.CheckReque
 		Now:      e.now(),
 	})
 	envelope.ID = decisionID(e.policy.Metadata, request, envelope)
+	if envelope.Signature == nil {
+		envelope.Signature = api.UnsignedEnvelopeSignature()
+	}
 	return envelope
 }