Sign decision envelopes and close FLEX-WP-0024.

Detached Ed25519 over the canonical envelope with signature omitted.
Unsigned is stated, not implied. Testdata fixtures prove verify and
tamper failure without minting a production key. FLEX-WP-0025 is
finished with the validate check from the previous commit.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

internal/sign/write_fixtures_test.go

@@ -0,0 +1,45 @@
+package sign_test
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/netkingdom/flex-auth/internal/sign"
+	"github.com/netkingdom/flex-auth/pkg/api"
+)
+
+func TestWriteReplaySignatureFixtures(t *testing.T) {
+	if os.Getenv("UPDATE_FIXTURES") != "1" {
+		t.Skip("set UPDATE_FIXTURES=1 to regenerate signed replay fixtures")
+	}
+	dir := filepath.Join("..", "..", "examples", "secrets-engine", "replay")
+	data, err := os.ReadFile(filepath.Join(dir, "decision_rotate.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var envelope api.DecisionEnvelope
+	if err := json.Unmarshal(data, &envelope); err != nil {
+		t.Fatal(err)
+	}
+	_, priv := fixtureKey()
+	if err := sign.Sign(&envelope, priv, "testdata-ed25519"); err != nil {
+		t.Fatal(err)
+	}
+	writeJSON(t, filepath.Join(dir, "decision_rotate_signed.json"), envelope)
+	envelope.Effect = api.DecisionEffectDeny
+	envelope.Reason = "tampered_after_signing"
+	writeJSON(t, filepath.Join(dir, "decision_rotate_signed_tampered.json"), envelope)
+}
+
+func writeJSON(t *testing.T, path string, value any) {
+	t.Helper()
+	data, err := json.MarshalIndent(value, "", "  ")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, append(data, '\n'), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}