[M0nsxx]

Summary

Re-lands #264's content directly against main. The original PR merged into issue-133-anchor (its stacked base) instead of main - by the time #263 merged to main, #264's commit hadn't landed there yet, so --sign/--key-env never actually shipped. GitHub still shows #264 as "merged," which is accurate but misleading here: merged into the wrong target.

Same spec as before:

nirium config set secretKey
nirium anchor --hash <64-hex> --sign
# or:
NIRIUM_KEY=S... nirium anchor --hash <64-hex> --sign --key-env NIRIUM_KEY

• Signs nirium-audit-v1:<content_sha256> locally with ed25519 - only the resulting signature and the derived public key (G...) leave this process, never the secret itself.
• Key source: --key-env <VAR> if given, otherwise the config store's secretKey. Either missing path fails locally with a clear message, before any network call.
• A malformed secret key is rejected locally too (Keypair.fromSecret throwing).
• If the node rejects the attestation, the response is 400 and nothing is anchored.

Test plan

• test/anchor-sign.test.js (7 cases) against a fake agent server that actually verifies the signature (same ed25519-over-statement check the real node does), not a stub that always accepts - so "bad signature -> 400, nothing anchored" is real. Covers: happy-path round trip through nirium verify (reports SIGNATURE: VALID against the same key) for both --hash and --record mode, a rejected signature, a malformed secret key, an unset --key-env variable, no key configured at all, and that omitting --sign leaves the request body unchanged.
• Full suite green: npm test - 106/106 (includes CLI: nirium anchor, anchor a file or hash to the Audit Trail #133/CLI: nirium verify should retry and fall back to another gateway #135/CLI: nirium report, summary and export from the Reporting node #136, already on main).
• node --check bin/nirium.js clean.

Closes #134

[Eras256]

Approving - re-lands #264's content directly against main this time (the original merged into the now-gone issue-133-anchor branch instead). Same spec: ed25519 attestation over nirium-audit-v1:<content_sha256>, key never leaves the machine or gets printed, throwaway Keypair.random() in tests. 106/106 tests pass locally, CI 3/4 green and the last one still running. Merging once it finishes.