A keyed server cannot serve a tip report about itself

`GET /tip` for a keyed server's own Principal Genesis returns `500` on every keyed server:

```
GET /tip?pr=
500 {"error":"attestation root re-derivation failed: malformed blob:
genesis blob must contain a 'key' field"}
```

The same principal's chain serves fine from `GET /patch` — one entry, two blobs, `200`. Only the tip attestation fails. Requesting the identifier without its hash prefix gives a plain `404`; the tagged form is the one the server files itself under.

## Cause

`sign_tip_attestation` (`rs/cyphr-server/src/routes.rs:242`) calls `rederive_roots`, which resolves genesis by reading key material out of the first stored commit's blobs (`rs/cyphr-storage/src/engine/mod.rs:462`). A server's own `principal/create` entry carries no key field.

That absence is deliberate and documented — the specification for receipts states the genesis key "is not otherwise reconstructible from served blobs", which is exactly why the discovery endpoint publishes it as a hint. Nothing passes that hint back into re-derivation.

`/tip` treats a re-derivation failure as a hard `500`; `/patch` logs it and serves unsigned (`routes.rs:393-403`), which is why only one of them breaks.

## Why it matters

The error names a malformed blob and reads as store corruption. The store is fine, and the condition is permanent rather than transient — no retry, reindex or restart changes it.

It also lands on a real use: a witness or an auditor monitoring a server's own chain reaches for `/tip` first, because that is the endpoint that returns something signed. They get a `500` describing a problem that does not exist, on a server that is working.

Start in rs/cyphr-server/src/routes.rs at sign_tip_attestation (line 242) and compare its re-derivation handling with the /patch path at routes.rs:393-403. Trace rederive_roots in rs/cyphr-storage/src/engine/mod.rs:462, then reproduce GET /tip with the server's tagged own Principal Genesis. Done means the request no longer returns a misleading 500 while the existing /patch behavior remains intact.

Written by the indexing model from the issue text.