feat(core): consolidate signing/verify primitives + scheme envelope (embedder P1a)

[suzuke]

Phase 1a — consolidate signing/verify primitives into agentic-git-core (embedder migration)

Second phase of the embedder migration. agentic-git repo only (agend-terminal daemon wiring + the daemon signer swap are P1b) → independently mergeable / revertable. Base: P0 merge 1de4fc6.

What

Moves the security contract into agentic-git-core so signer and verifier share ONE source:

• ensure_key — the lock-free first-writer-wins hard_link key provisioning, moved verbatim from the run CLI into core (the single key primitive), with its open_new_0600 helper. Core gains a getrandom dep. The run CLI now calls core::ensure_key / core::sign_binding (local copies removed).
• sign_binding = ensure_key + sign — closes the reviewer4 hole where the low-level sign panicked on a fresh home.
• verify → typed Result<(), VerifyError> (MissingKey | MalformedTag | MacMismatch | UnsupportedScheme{tag_scheme, runtime_scheme}). Parses a self-describing tag envelope (ag-hmac-sha256:v<algo>:<key-format>:<hex>) before the MAC check, so an HMAC scheme skew is diagnosable — the shim maps UnsupportedScheme to a loud deny (verify_sidecar) instead of a silent "unbound".
• BINDING_FORMAT_VERSION / HMAC_ALGO_VERSION consts + envelope_tag (the "can produce" capability).

⚠ Ordering invariant (fleet-safety)

The default emit stays bare hex (implicit scheme v1) — byte-identical to the pre-P1a signer — so an unswapped shim and every on-disk sidecar keep verifying. The envelope is a capability core can parse + produce, not the default output (that flips in a later phase). RED-first proven: making sign_binding emit the envelope fails the byte-identical test against an independent python-HMAC oracle (38a831c3…).

reviewer4 acceptance conditions (RED-first, in p1a_contract.rs)

• fix: review-1 findings — legacy-fleet compat + self-referential REAL_GIT foot-gun #2 a malformed ag-hmac-sha256:-prefixed tag NEVER falls back to bare-hex legacy (extra colon / non-v algo / non-hex MAC / unknown key-format → MalformedTag/UnsupportedScheme).
• feat: session mode — agentic-git run (#1) #3 a newer scheme (v2) or any tamper (bit-flipped MAC, wrong content, wrong MAC in a valid envelope) NEVER authenticates.
• P2: recovery layer — pre-destructive-op snapshots + lazy prune (design for adversarial review) #4 bare-hex legacy accepted (the migration window).
• P1: session mode — agentic-git run (design for adversarial review) #1 lockfile-single-source is P1b (agend-terminal) — out of scope here.

Regression

The run CLI's concurrent first-writer-wins is preserved: the existing session_mode race tests (which drive the real run binary concurrently and assert one 32-byte key survives + both bindings verify) stay green through the core reroute, plus a new direct core-level N-thread race test.

Verification

cargo test --workspace 0-failed; cargo clippy --workspace --all-targets -D warnings clean; cargo package -p agentic-git-core green.

For DUAL re-review

• reviewer4: HMAC/envelope/typed-verify correctness + the byte-identical ordering invariant (a mistake here = fleet fail-closed).
• dev3: no new fail-open (does the envelope parse or the UnsupportedScheme/legacy split let a forged/downgraded tag authenticate?); the legacy window is not a downgrade vector.