fix: reject non-ed25519 signing keys

[endscene665]

Summary

• reject public keys whose parsed Node KeyObject type is not ed25519
• add a regression test proving an RSA-signed receipt with signatureAlg: "ed25519" was accepted before the fix

Why

verifyReceipt() checks the receipt algorithm label, but resolvePublicKey() previously accepted any SPKI public key. Node's verify(null, ...) verifies RSA, ECDSA, and Ed448 signatures too, so the verifier could report success for receipts that were not signed with Ed25519.

Validation

• npm test -- --run
• npm run build
• git diff --check