Authenticate confidential managed-node reads

[TeoSlayer]

Summary

• sign policy, trust, mandate, fleet, and approval-status reads with the enrolled node's delegated Ed25519 key
• bind each signature to method, path, canonical query, tenant, agent, key, timestamp, nonce, and body digest
• configure managed runtimes automatically while preserving unmanaged/local operation
• cover every confidential route and the workflow-status signer in tests

Verification

• GOWORK=off go test ./...
• GOWORK=off go vet ./...
• GOWORK=off go test -race ./internal/managedsdk/authorityhttp ./internal/managedsdk/decisionhttp ./internal/enterprisecontrol