feat: air-gapped verification infrastructure

[avrabe]

Summary

Adds comprehensive support for offline/air-gapped WebAssembly signature verification, enabling devices without network access to verify Sigstore keyless signatures.

Key Features

• Trust Bundle Format: Signed, versioned container of trust anchors (Fulcio roots, Rekor keys)
• TUF Integration: Fetch current Sigstore trusted root via TUF protocol
• Storage Abstraction: TrustStore/KeyStore traits for HSM/TPM/secure element support
• Security Hardening: Anti-rollback protection, bundle validity checks, certificate pinning
• CLI Commands: bundle fetch, bundle inspect, bundle verify
• Time Abstraction: TimeSource trait for embedded devices without RTC

Architecture

SIGNING (CI - Online)              VERIFICATION (Device - Offline)
─────────────────────              ────────────────────────────────

GitHub Actions                     Embedded Device
(OIDC → Fulcio → Rekor)           ┌─────────────────────────────┐
        │                         │  Trust Bundle (provisioned) │
        ▼                         │  • Fulcio root certs        │
┌─────────────────┐               │  • Rekor public key         │
│  Signed WASM    │  distribute   │  • Bundle version           │
│  • Signature    │ ───────────►  └─────────────┬───────────────┘
│  • Cert chain   │                             │ verifies
│  • Rekor entry  │                             ▼
└─────────────────┘               ┌─────────────────────────────┐
                                  │  Signed WASM (verified)     │
                                  └─────────────────────────────┘

New Files

File	Purpose
src/lib/src/airgapped/	Core air-gapped verification module
src/lib/src/time.rs	Time source abstraction for embedded
src/lib/src/secure_file.rs	Secure file operations
src/lib/tests/airgapped_e2e.rs	End-to-end tests
.github/workflows/wasm-signing.yml	Example signing workflow

CI Additions

• Air-gapped verification tests (unit + OIDC integration)
• Sign & verify example workflow
• Fuzz testing targets for security-critical code

Related Issues

• Addresses Issue 🔴 [CRITICAL] Replace unwrap()/expect() with proper error handling #13: Error handling improvements
• Addresses Issue 🟡 [HIGH] Add certificate pinning for Sigstore endpoints #12: Certificate pinning for Sigstore endpoints

Test plan

• cargo test - All 472+ tests pass
• cargo test --test airgapped_e2e - E2E tests pass
• CI workflow runs successfully
• Keyless integration tests pass with OIDC