Public keys for signed policy bundles

An edge installation counts the governed actions it decided per UTC month from its hash-chained evidence and reports them as a compact JWS (`EdgeUsageReportHeader`, `EdgeUsageReportClaims`) signed with an Ed25519 key the organization registered at `/v1/execution/provider-keys` with purpose `usage_report` and the installation id as its `issuer`. Verified like an effect receipt: the header, the key (this organization's, this purpose only), the signature, `iss` = the key's issuer, `aud` = the organization, `iat` at most 5 minutes ahead, a month that has begun, and claims that add up (each breakdown sums to `total`, `delegated` <= `total`, the chain range present exactly when something was counted, `period_start`/`period_end` the month's bounds). A refused report is answered 422 with its code and not stored. One report per installation and month is current. The same report again is answered 200 with the stored record (`replay: true`). A different report for the same installation and month is accepted only when it counts further along the same chain stream (a higher `chain.last_seq`): it supersedes the current one, which stays on record pointing at it; otherwise 409. A stored report adds `total - delegated` governed actions (minus what earlier reports for that installation and month already metered) to the organization's usage through the governed-action meter hosted decisions use, dated in the reported month when the meter still accepts it, so plans, allowances and overage apply unchanged. `delegated` decisions were decided by hosted Decionis, which metered them already. Metering is fail-open: the report is recorded either way, with `meter_status`. Requires an organization API key with `policy:read`, `policy:write`, `policy:*` or `org:*`: the report's signature, not the API key, is what is trusted.