Reject revoked remotely resolved signing keys

[Mirochill]

Summary

• preserve backward compatibility for remote key records without lifecycle metadata
• accept remotely resolved active and rotated keys
• reject remotely resolved revoked keys before their key material can be used
• fail closed for unknown explicit remote key statuses
• add regression coverage for rotated, revoked, and unknown statuses

Why

The public key-rotation documentation states that historical rotated keys remain usable for verification, while revoked keys must fail immediately. The resolver previously selected a remote key by id and ignored the returned lifecycle metadata, allowing a matching revoked Ed25519 key to verify receipts successfully.

Fixes permission-protocol/deploy-gate#50.
Related bounty: permission-protocol/deploy-gate#36.

Validation

• npm test
• npm run build
• git diff --check
• reran the local revoked-key reproducer from deploy-gate#50 and confirmed KEY_RESOLUTION_FAILED with exit code 4