Add signed payload trailers (#66)

[sehkone]

Summary

• Adds append_trailer_signed, allowing caller-owned signing to stamp a detached Ed25519 signature and matching key_id into packages and installer payloads.
• Validates signer results before writing output, preserves unsigned writer output, and keeps present envelope offsets valid across trailer rewraps.
• Adds signer error propagation, verification round trips, and release notes for the public API.

Closes #66

Test plan

• Verify signed .pkg and installer payloads against a fixture trust set, including a signed rewrap.
• Confirm the callback receives the exact manifest bytes written to the container.
• Reject invalid signature and key_id values, and signer failures, before any output is written.
• Confirm the unsigned entry point remains byte-for-byte unchanged and keeps both envelope pairs absent.
• Run cargo fmt -- --check --config group_imports=StdExternalCrate.
• Run both required cargo clippy configurations and both required cargo test configurations.

[sehkone]

[Reviewer Round 1]

No findings.

The PR implements Issue #66 as specified: it adds the callback-based signed writer, validates signature and key_id before output, preserves the unsigned API, and correctly carries signed envelope blocks through rewrap. The tests cover real verification for package and installer forms, callback-byte identity, validation/error propagation, and signed rewrap.

PR hygiene is also sound: PR #67 closes #66, includes a test plan, and has no review-thread issue creation or unrelated linkage.

[sehkone]

[Review Verdict Round 1: APPROVED]

[sehkone]

Suggested squash commit

Title

Add signed payload trailer writer

Body

Allow release tooling to stamp verified containers while keeping signer
configuration and private key custody outside deploy-core.

Closes #66