Sign and bind delivery acknowledgements

[fedoseevstanislav]

What changed

• define SignedAckV1 with an Ed25519 signature over the message digest, conversation, ACK sender, intended recipient, status, timestamp, and nonce
• emit signed NATS ACKs from the daemon by default while retaining rolling-upgrade compatibility
• verify signed ACKs against the pending outbox record and expected peer key
• reject wrong-message, wrong-conversation, wrong-recipient, wrong-peer, stale/future, invalid-signature, and replay/non-in-flight ACKs
• apply ACK/NACK state changes atomically only from the sent state
• meter invalid attempts by bounded reason and emit metadata-only security events; raw ACK/message bodies are not logged
• add the protocol schema, canonical signing payload, migration documentation, and conformance/security tests

Migration behavior

This is deliberately two-stage to avoid interrupting a live cross-host mesh:

1. upgraded daemons emit signed ACKs by default, which legacy peers can still parse
2. after every peer is upgraded, enable ackSecurity.requireSigned: true or MURMUR_REQUIRE_SIGNED_ACKS=1

Strict mode is implemented and covered, but remains opt-in until peer rollout is complete.

Validation

• npm test — complete repository suite passed
• focused signed-ACK, schema conformance, canonical-payload, and atomic SQLite transition tests passed
• npm run build
• git diff --check

Tracks fedoseevstanislav/ops#728.