test(config): verify signed client vector (CODE-537)

[AprilNEA]

Summary

• add the cloud-owned deterministic config-signing fixture to @linkcode/common
• verify RFC 8785/JCS canonical bytes, Base64URL decoding, SHA-256, RFC 8032/config-pointer/emergency Ed25519 signatures, and mutated-signature rejection
• exercise Chromium WebCrypto and Noble in the actual unpackaged Electron renderer
• compile the Noble verification path into Android and iOS Hermes bundles without adding a native module or WebCrypto polyfill

Runtime evidence

• Electron: actual renderer runtime passed with PASS Electron WebCrypto and Noble config signing vector and the existing unpackaged main/preload/renderer smoke test.
• Expo/Hermes: Android and iOS production exports passed and include the POC in Hermes bytecode. This is bundle/compile proof only; no simulator or physical-device runtime was executed. Hermes does not provide the required WebCrypto Ed25519 path, so the POC uses pure-JS @noble/ed25519 and @noble/hashes.

Validation

• pnpm test packages/foundation/common/src/config-signing-poc — 3/3 passed
• xvfb-run -a pnpm -F @linkcode/desktop e2e:unpackaged — Electron renderer runtime passed
• pnpm -F @linkcode/mobile smoke:export — Android and iOS Hermes exports passed
• pnpm typecheck
• pnpm format:check
• pnpm lint:ci — full lint with concurrency disabled passed
• pnpm test — 305 files passed, 1 skipped; 2,442 tests passed, 1 skipped

Linear: CODE-537

[linear-code]

CODE-537