fix(swim): verify ECDSA P-256 signatures on pinned-origin state broadcasts (grid#75, partial)

[jordigilh]

Summary

Partial fix for #75 — implements the confident, already-agreed-on part of the
signing design (ECDSA P-256 sign/verify primitives, an additive signed wire
format, and a pinned-origin verification gate in receive_item) while the
signing-key-sourcing question remains an open architectural fork awaiting
maintainer consensus (see the issue thread). No CRD, controller, or
swim_runtime.rs wiring is included here — trust_store_sender() has no
caller yet, so this is inert (a documented no-op) in production today.

What's built

1. swim::signing — sign_ecdsa_p256/verify_ecdsa_p256, deliberately
   decoupled from where key material comes from: callers supply raw PKCS8
   DER (signing) or a raw uncompressed EC point (verification), matching how
   a GridSite's certificate key material is already produced elsewhere in
   this repo.
2. Additive wire format — StateBroadcast gains signature: Option<Vec<u8>>, following the same #[serde(skip_serializing_if)]
   pattern already used for site_cert_pem/gateway_address. Older
   decoders are unaffected; signable_bytes() returns the canonical bytes a
   signature covers (the payload with signature cleared).
3. Verification gate — StateBroadcastHandler gains a TrustStore
   (BTreeMap<String, Vec<u8>>, origin site → raw public key) fed by a
   watch::Sender/Receiver pair, following the exact precedent
   SwimHandle::set_swim_key() already uses to bridge async K8s state into
   this crate's sync receive_item. verify_signature_if_pinned() runs
   before make_room_for()/state merge, so a rejected broadcast never
   touches retained-origin state:
   • No pinned identity for the origin → pass through unchanged (deliberate:
     lets a signed-broadcast rollout proceed incrementally, one origin at a
     time, instead of requiring a synchronized flag-day cutover).
   • Pinned identity + missing/wrong-key/tampered signature → rejected, with
     a tracing::warn! carrying origin_site and a closed-set reason tag
     (never the broadcast body) — closing a gap this repo's own review
     thread flagged for bounded rejection observability.

Testing (TDD RED → GREEN → REFACTOR, pyramid invariant)

• Unit — 14 new tests (81 → 95 in the swim crate): sign/verify
  round-trip, malformed-key rejection, tampered-payload rejection,
  wrong-key rejection; all four verify_signature_if_pinned decision
  branches (unpinned pass-through, missing-signature reject, wrong-key
  reject, correctly-signed accept) driven through the real receive_item
  path, not direct construction; Display-message coverage for all six new
  error variants, matching this repo's own
  node::tests::state_broadcast_error_formats_correctly convention.
  cargo llvm-cov confirms every reachable decision branch in the new code
  is exercised — the only uncovered arm (SignableEncode's encode-failure
  case) has no trigger reachable through this crate's public API, the same
  class as this file's pre-existing PoisonError::into_inner recovery
  paths.
• Integration / E2E — intentionally absent, not silently skipped: there
  is no reconciler or real signing call-path yet to exercise (that's the
  pending trust-store-wiring work below). Both tiers become real
  requirements, not optional, once that wiring lands.

Validation

• cargo test --workspace — 2,188/2,188 passing
• cargo clippy --workspace --all-targets -- -D warnings — clean
• cargo +nightly-2026-03-28 fmt --all -- --check — clean
• cargo doc -p swim --no-deps — clean
• cargo machete — clean
• cargo deny check — advisories/bans/licenses/sources all ok

Explicit non-goals here, tracked in #75

• Signing-key sourcing (dedicated key/Secret vs. reusing tls.key) — open
  question posted to the issue, awaiting @nerdalert / maintainer input.
• Wiring trust_store_sender() from GridSite reconcile into the operator's
  SWIM runtime — depends on the above; precedent identified
  (SwimHandle::set_swim_key()) but not yet implemented against a real
  source.
• A rollout cutover mechanism (stop accepting unsigned broadcasts from
  unpinned origins once every peer signs) — currently open-ended by design
  for incremental rollout; needs explicit design once the above lands.
• A bounded Prometheus counter for rejection reasons — the tracing::warn!
  added here gives a structured, bounded-cardinality signal today; a real
  counter needs the swim crate's non-existent dependency on the operator's
  metrics pipeline, a bigger wiring decision than this slice.
• Whether "drop non-Active" broadcast policy extends to tenant_spend
  (currently ProviderState-only, matching existing
  is_crdt_provider_routing_eligible precedent) — flagged as open in the
  issue thread, no production path reports spend yet (No production path reports gateway spend into Grid's tenant_spend GCounter — increment_tenant_spend is only called from tests #69).

@nerdalert — this is the confident slice from our discussion on #75; the
mechanism questions you raised should be answered as posted in the issue.
Would appreciate your review, especially on the verification-gate ordering
and the rollout pass-through behavior for unpinned origins.

[jordigilh]

@nerdalert PTAL — implements the confident slice from our #75 discussion (sign/verify primitives, wire format, verification gate); key-sourcing question is still open on the issue.

[praxis-bot]

Reviewed the ECDSA P-256 signing/verification primitives, wire format changes, trust store integration, and test coverage. One finding on wire format backward compatibility during rolling updates.

[nerdalert]

Thanks for putting together the signing and verification foundation. Verification happens before capacity eviction or state mutation, and the rolling-wire compatibility follow-up addresses the earlier bot finding. I found four lifecycle and trust-boundary issues that I think should be resolved or explicitly designed before this becomes the basis for production enforcement.