feat(tbtc): add covenant signer job substrate

[mswilkison]

Summary

• add a new pkg/covenantsigner substrate package with durable submit/poll semantics for covenant signer jobs
• wire an optional covenantSigner.port HTTP server into keep start backed by work persistence
• add route-aware request validation, job dedup by routeRequestId, health endpoint, and targeted tests

Scope

This is the first keep-core covenant signer extension slice only:

• common covenant job domain
• persistent store
• HTTP+JSON signer-provider surface
• request validation and idempotency

It does not yet implement the real signer cryptography / artifact generation path. The default engine accepts jobs and leaves them pending until the signing internals are plugged in by follow-up work.

Verification

• go test ./pkg/covenantsigner
• go test ./config ./cmd