WitSeal execution receipts for Cloudflare Workers (demo)

This Worker produces a canonical WitSeal v0.2 execution receipt in-isolate via
WebCrypto, for an isolate-native action it owns (SHA-256 over the request body).
The receipt verifies VALID under the unmodified Node `witseal verify`.

  GET  /pubkey             -> Ed25519 public key (hex) for: witseal verify <file> --public-key <hex>
  POST /receipt            -> signed v0.2 receipt JSON for the SHA-256 of the POST body
  GET  /attestation        -> the build's DSSE in-toto attestation (sha256 == receipt.attestation_digest)
  GET  /attestation/pubkey -> builder public key (hex): the trusted --builder-key for --check-provenance

Verify a returned receipt:
  curl -s -X POST <worker-url>/receipt --data-binary @payload.bin > receipt.json
  curl -s <worker-url>/pubkey
  node dist/src/cli/index.js verify receipt.json --public-key <hex-from-/pubkey>

Close the build-provenance loop (independent re-check of the attestation):
  curl -s <worker-url>/attestation > attestation.json
  curl -s <worker-url>/attestation/pubkey
  node dist/src/cli/index.js verify receipt.json --public-key <hex-from-/pubkey> \
    --check-provenance --attestation attestation.json --builder-key <hex-from-/attestation/pubkey>