slice 10B: operator-signed destructive completion (offline key + signing CLI) (v0.16.0)

A destructive op runs ONLY on a pinned-key-verified, nonce-fresh, in-window,
host-bound, durable-id-bound operator signature. New cmd/felhom-opsign signs
canonical OpBlobs offline via ssh-keygen -Y sign (hardware-ready); the signing
key is never in the hub or agent. New internal/signedjobs runner verifies each
queued blob through the gate and only on all-pass runs the WipeExecutor, which
re-resolves the DURABLE device id + re-inspects (8C) before mkfs — closing the
8C data-bearing-wipe pending_signature gap. New storage durable-device
resolution; authz.CanonicalBlob promoted to production. Real-crypto tests assert
valid executes and forged/replay/expired/retarget/non-pinned are rejected
(executor never called).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/localapi/disks_test.go

@@ -129,8 +129,8 @@ func TestFormat_DataBearingDevice_RefusedNoMkfs(t *testing.T) {
 	if len(g.calls) != 1 || g.calls[0] != "/dev/sdb" {
 		t.Fatalf("gate not consulted for the destructive format: %v", g.calls)
 	}
-	if !strings.Contains(w.Body.String(), "operator authorization") {
-		t.Fatalf("response did not signal operator-authorization needed: %s", w.Body.String())
+	if !strings.Contains(w.Body.String(), "operator signature") {
+		t.Fatalf("response did not signal an operator signature is needed: %s", w.Body.String())
 	}
 }