fix: handle malformed signature keys

[be-student]

What & why

Malformed public keys embedded in a receipt raised decoding or cryptography exceptions. Verification now reports them as a failed signature check so untrusted receipts always produce a structured verdict.

Changes

• catch malformed Ed25519 public keys at the signature verification boundary
• cover invalid base64, valid base64 with the wrong key length, and non-ASCII input
• document the fix in the changelog

Checklist

• Focused change with a clear description
• Ran format / lint / tests (see README)
• Updated docs or CHANGELOG if relevant
• Linked any related issue

Closes #9

Validation: pytest -q; ruff check .; python examples/demo_rag.py; git diff --check.