fix(auth): authenticate producer-signed decisions before authorization

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

verifier/testsupport/signer/main.go

@@ -0,0 +1,28 @@
+// Synthetic test-only signer with the producer's published nonproduction seed.
+package main
+
+import (
+	"bytes"
+	"crypto/ed25519"
+	"encoding/json"
+	"github.com/netkingdom/access-engine/internal/sign"
+	"github.com/netkingdom/access-engine/pkg/api"
+	"os"
+)
+
+func main() {
+	seed := byte(0x42)
+	kid := "testdata-ed25519"
+	if len(os.Args) > 1 {
+		seed = 0x43
+		kid = "next-admitted"
+	}
+	var env api.DecisionEnvelope
+	if json.NewDecoder(os.Stdin).Decode(&env) != nil {
+		os.Exit(1)
+	}
+	if sign.Sign(&env, ed25519.NewKeyFromSeed(bytes.Repeat([]byte{seed}, 32)), kid) != nil {
+		os.Exit(1)
+	}
+	json.NewEncoder(os.Stdout).Encode(env)
+}