Add brokerless MPC ceremony inspection and receipts

[mellowcroc]

Stack

This is a stacked PR based on #1. After #1 merges, retarget this PR to main.

What changed

• Add authoritative JSON inspection commands for ceremony definitions, accepted chains, participant signing-key identity, and operational enrollments.
• Authenticate participant keys with the existing hardened Ed25519 key loader and report role-safe schedule projections without signing or exposing private material.
• Verify enrollment proofs of possession for public witnesses and mirror operators.
• Add offline preparation for public-witness and immutable-mirror receipts.
• Authenticate signed closure and chain inputs, derive canonical records internally, and export fresh signing requests for offline signature import.
• Preserve the existing read-only recovery-state inspect command added by Audit hardening: validation, gate alignment, and operational fixes for the ceremony #1.

Why

Relay's brokerless, role-scoped storage flow needs stable machine-readable projections and canonical operational records, but Relay should not duplicate ceremony parsing, identity interpretation, signature verification, closure validation, or record construction. These commands keep those trust-boundary responsibilities inside proof-tool and add no networking or Relay-specific storage code.

Security properties

• No network access.
• No automatic witness or mirror signing.
• No private-key bytes in JSON output.
• Bounded regular-file reads and hardened existing-key loading.
• Exact detached-signature verification.
• Safe transcript-relative artifact names.
• Publication locations hashed before canonical receipt construction.
• Fresh output directories with partial-publication cleanup.
• Production witness timing honors Audit hardening: validation, gate alignment, and operational fixes for the ceremony #1's reserved observation window.

Validation

• go test ./internal/mpcceremony
• go test ./cmd/mpc-ceremony -skip '^TestProductionCeremonySourceAndBinaryExcludeWalletSecretAPIs$'
• go test ./internal/keybundle
• git diff --check

The exact CLI package command still reaches the repository's existing inconsistent vendor/modules.txt boundary failure. The broader compile sweep also retains the existing fft.WithCosetTable dependency mismatch in internal/msmengine; neither dependency surface is changed here.