feat(eval): operator offline answer-key signing CLI

[ProtocolWarden]

What

Adds operations_center.eval.sign — the tool the operator runs offline to perform the one irreducibly-human step in the trust-hardening spec: anchoring the EVAL answer key so the gate can graduate from report-only to blocking.

This is the deliberate completion of the human-anchor seam left by #369. It is not automated and not called by any fleet/controller path — the private key it consumes must never touch a fleet host (a key reachable by a compromised agent could forge answer-key labels, which is the exact attack the design prevents).

Subcommands

• keygen — generate an Ed25519 keypair. Writes the PEM private key (you keep it offline) and prints the public-key hex to paste into eval/constitution/operator_pubkey.ed25519.
• sign — convert unsigned candidate cases into signed graded cases with your offline private key (idempotent; --case-id to limit which). Re-chains the ledger via the new corpus.write_ledger (adding a signature changes an entry's hash, so the chain after it is recomputed) — verify_chain still validates the result.

Why a CLI instead of just doing it

I declined to generate or hold the signing key in-session. A key generated on a fleet-reachable host, by the agent that builds the eval, would collapse the un-forgeable anchor the whole design rests on (self-dealing + a label-forging key sitting next to the attacker). The tooling keeps key generation and custody with the operator while making their manual step a single command.

Verified end-to-end (throwaway ephemeral key, never committed)

report-only: 0/7 signed → gate report-only, all 7 candidates pass
keygen → sign 7 seeds
after: 7 graded → gate [blocking]: all graded cases pass and floor is cleared
tamper (flip a signed answer in place) → TAMPER: entry_hash mismatch, RESULT FAIL

41 eval unit tests (keygen roundtrip, candidate→graded conversion, idempotency, case-id limiting, CLI flows). ruff / ty / Custodian D12 clean.

Operator runbook (to graduate the real gate, when ready)

1. Offline: python -m operations_center.eval.sign keygen --private-out operator_priv.pem → keep operator_priv.pem off all fleet hosts.
2. Paste the printed public hex as the sole first line of eval/constitution/operator_pubkey.ed25519.
3. Review the candidate cases, then python -m operations_center.eval.sign sign --private operator_priv.pem (after adding cases to reach min_graded_cases).
4. Commit the pubkey + signed ledger. CI flips the gate to blocking.

🤖 Generated with Claude Code

[ProtocolWarden]

Resolved: superseded by new push — re-review resumed

Self-review concerns — auto-fixing (up to 6 attempts; re-queued if still unresolved):

Failed checks: code_quality