slice 10B: operator-signed destructive completion (offline key + signing CLI) (v0.16.0)

A destructive op runs ONLY on a pinned-key-verified, nonce-fresh, in-window,
host-bound, durable-id-bound operator signature. New cmd/felhom-opsign signs
canonical OpBlobs offline via ssh-keygen -Y sign (hardware-ready); the signing
key is never in the hub or agent. New internal/signedjobs runner verifies each
queued blob through the gate and only on all-pass runs the WipeExecutor, which
re-resolves the DURABLE device id + re-inspects (8C) before mkfs — closing the
8C data-bearing-wipe pending_signature gap. New storage durable-device
resolution; authz.CanonicalBlob promoted to production. Real-crypto tests assert
valid executes and forged/replay/expired/retarget/non-pinned are rejected
(executor never called).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/authz/mint_test.go

@@ -6,7 +6,6 @@ import (
 	"crypto/sha256"
 	"encoding/binary"
 	"encoding/pem"
-	"fmt"
 	"testing"
 	"time"
 
@@ -17,17 +16,14 @@ import (
 // production framing. They reuse the production signedData()/sshsigBlob so a test
 // can never drift from the verifier's notion of the signed bytes.
 
-// canonicalBlob builds an op blob in the §2 canonical field order. (Self-consistent
-// for the in-Go path: we sign exactly these bytes and verify the same bytes. The
-// committed ssh-keygen fixture exercises real OpenSSH canonical interop.)
+// canonicalBlob delegates to the production CanonicalBlob (so the in-Go test minting can never
+// drift from the real signed-bytes path). Panics on a params error — tests pass valid JSON.
 func canonicalBlob(op, hostID, guestID, keyID, nonce, paramsJSON string, issued, expires time.Time) []byte {
-	if paramsJSON == "" {
-		paramsJSON = "{}"
+	b, err := CanonicalBlob(op, hostID, guestID, keyID, nonce, paramsJSON, issued, expires)
+	if err != nil {
+		panic(err)
 	}
-	return []byte(fmt.Sprintf(
-		`{"expires_at":%q,"issued_at":%q,"key_id":%q,"nonce":%q,"op":%q,"params":%s,"target":{"guest_id":%q,"host_id":%q}}`,
-		expires.UTC().Format(time.RFC3339), issued.UTC().Format(time.RFC3339),
-		keyID, nonce, op, paramsJSON, guestID, hostID))
+	return b
 }
 
 // mintArmor builds an armored SSHSIG over message, using sign to produce the inner