wip(trust): park agent's signed-manifest module + release-root key off main

Moved here so main stays clean for the v1.7.98 release. Contains the trust/
module (canonical.rs, did.rs, signed_doc.rs) + seed::derive_release_root_ed25519.
Not wired into the build yet. Continue this work on this branch.

core/archipelago/src/trust/mod.rs

@@ -0,0 +1,23 @@
+//! Authenticity layer for the DHT distribution plan (Phase 0).
+//!
+//! Content addressing (SHA-256 today, BLAKE3 later) proves downloaded bytes are
+//! *intact*. It does not prove they were *authorized*. This module adds the
+//! missing half: detached Ed25519 signatures over canonical JSON, verified
+//! against a pinned **release-root** trust anchor.
+//!
+//! Layout:
+//!   * [`anchor`]    — the pinned release-root public key (+ env override).
+//!   * [`canonical`] — deterministic JSON serialization for signing.
+//!   * [`did`]       — `did:key` <-> Ed25519 public key.
+//!   * [`signed_doc`]— detached sign/verify over a signed document.
+//!
+//! The release-root *private* key is publisher-only and derived in the signing
+//! ceremony via [`crate::seed::derive_release_root_ed25519`]; fleet nodes only
+//! ever hold the public key.
+
+pub mod anchor;
+pub mod canonical;
+pub mod did;
+pub mod signed_doc;
+
+pub use signed_doc::{verify_detached, SignatureStatus};