WitSeal execution receipts for Cloudflare Workers (demo)

This Worker produces a canonical WitSeal v0.2 execution receipt in-isolate via
WebCrypto, for an isolate-native action it owns (SHA-256 over the request body).
The receipt verifies VALID under the unmodified Node `witseal verify`.

  GET  /pubkey    -> Ed25519 public key (hex) for: witseal verify <file> --public-key <hex>
  POST /receipt   -> signed v0.2 receipt JSON for the SHA-256 of the POST body

Verify a returned receipt:
  curl -s -X POST <worker-url>/receipt --data-binary @payload.bin > receipt.json
  curl -s <worker-url>/pubkey
  node dist/src/cli/index.js verify receipt.json --public-key <hex-from-/pubkey>