[M0nsxx]

Summary

Stacked on #263 (#133). Adds --sign/--key-env <VAR> to nirium anchor:

nirium config set secretKey
nirium anchor --hash <64-hex> --sign
# or:
NIRIUM_KEY=S... nirium anchor --hash <64-hex> --sign --key-env NIRIUM_KEY

• Signs nirium-audit-v1:<content_sha256> locally with ed25519 - only the resulting signature and the derived public key (G...) leave this process, never the secret itself.
• Key source: --key-env <VAR> if given, otherwise the config store's secretKey. Either missing path fails locally with a clear message, before any network call.
• A malformed secret key is rejected locally too (Keypair.fromSecret throwing).
• If the node rejects the attestation, the response is 400 and nothing is anchored.

Test plan

• New test/anchor-sign.test.js (7 cases) against a fake agent server that actually verifies the signature (same ed25519-over-statement check the real node does), not a stub that always accepts - so the "bad signature -> 400, nothing anchored" case is real, not simulated. Covers: happy-path round trip through nirium verify (reports SIGNATURE: VALID against the same key) for both --hash and --record mode, a rejected signature, a malformed secret key, an unset --key-env variable, no key configured at all, and that omitting --sign leaves the request body unchanged (no agent field).
• Full suite green: npm test - 83/83.
• node --check bin/nirium.js clean.

Closes #134

[Eras256]

Approving — ed25519 attestation over nirium-audit-v1:<content_sha256>, key never leaves the machine or gets printed, tests use a throwaway Keypair.random(). No CI yet because this is stacked on #263's branch — expected, it'll run once #263 merges and this retargets to main. Will re-check CI after that before final merge.