Sign decision envelopes and close FLEX-WP-0024.

Detached Ed25519 over the canonical envelope with signature omitted.
Unsigned is stated, not implied. Testdata fixtures prove verify and
tamper failure without minting a production key. FLEX-WP-0025 is
finished with the validate check from the previous commit.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

schemas/decision_envelope.schema.json

@@ -69,6 +69,10 @@
     "provenance": {
       "$ref": "#/$defs/provenance"
     },
+    "signature": {
+      "$ref": "#/$defs/envelope_signature",
+      "description": "Detached Ed25519 signature over the canonical envelope with this field omitted. Additive: request_digest is unaffected (FLEX-WP-0024). mode unsigned states absence rather than omitting the field."
+    },
     "caring": {
       "$ref": "#/$defs/caring_decision_metadata"
     }
@@ -235,6 +239,33 @@
         }
       }
     },
+    "envelope_signature": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "mode"
+      ],
+      "properties": {
+        "mode": {
+          "enum": [
+            "signed",
+            "unsigned"
+          ]
+        },
+        "alg": {
+          "const": "ed25519"
+        },
+        "kid": {
+          "type": "string",
+          "minLength": 1
+        },
+        "value": {
+          "type": "string",
+          "minLength": 1,
+          "description": "base64url Ed25519 signature over json.Marshal of the envelope with signature omitted"
+        }
+      }
+    },
     "caller_provenance": {
       "type": "object",
       "additionalProperties": false,