Implement legacy receipt verification & improve config/health surface

[GsCommand]

Summary

This PR restores legacy receipt verification helpers for backward-compatibility test coverage, improves the health endpoint surface, refactors error handling in handleVerb, and updates configuration documentation to reflect current practices.

Key Changes

Layer 3 (Execution Runtime) — receipt-verification.js

• Restored resolveSigner(), resolveSignatureKey(), and verifyReceipt() as legacy helpers for test_vectors schema
• These implement the older per-field ENS delegation model used by test fixtures but are NOT on the production hot path
• All production signing/verification remains delegated to @commandlayer/runtime-core (Layer 2)
• Added internal helpers: decodeBase64() and ed25519RawToSpkiPem() for ed25519 key handling

Layer 3 (Execution Runtime) — server.mjs

• Health endpoint: Added verifier_ok field to /health response (true when public key or ETH_RPC_URL is configured)
• Error handling: Moved execution computation outside try/catch in handleVerb() so error path can reuse it without re-parsing consumed request body
• doClean verb: Fixed field name from cleaned → cleaned_content and added fallback paths for body.content and body.input.content
• doSummarize verb: Added fallback for body.content input path
• Validator warm queue: Declared before handleVerb() to avoid temporal dead zone
• Removed dead code: Eliminated unused const text = await resp.text() in doFetch()
• Minor cleanup: Removed extra blank lines, fixed console.log format (removed http:// prefix)

Configuration & Documentation

• .env.example: Updated to reflect current key naming (RECEIPT_SIGNER_ID as canonical) and encoding (RECEIPT_SIGNING_PRIVATE_KEY_PEM_B64 for base64-encoded PKCS8)
• CONFIGURATION.md: Documented rate limiting section with RATE_LIMIT_WINDOW_MS and RATE_LIMIT_MAX defaults; moved these from "deprecated" to "active" section
• SECURITY.md: Clarified rate limiting is always active; documented /health and /healthz exclusions; noted RATE_LIMIT_ENABLED is not a live toggle
• scripts/smoke.mjs: Updated health check to allow verifier_ok to be absent (only fail if explicitly false)

Implementation Details

• Legacy verification helpers use Node's crypto.createVerify() with ed25519 algorithm and SPKI PEM format
• ENS resolution is async and returns structured error objects with { valid: false, error: string } for all failure paths
• Error handling refactor in handleVerb() ensures the error catch block has access to execution without re-parsing the request body (which may have been consumed by the try block)
• Health endpoint now accurately reflects whether verification infrastructure is available, supporting both local key and remote ENS-backed verification modes

Contract Impact

• No protocol schema changes; all receipt shapes remain unchanged
• Health endpoint gains optional verifier_ok field (backward compatible; clients can ignore)
• Legacy verification is test-only; production verification remains in runtime-core

https://claude.ai/code/session_01GQcff5HnFcrTbyuwuvsNEv