TSS and WRAPS Support

## Context

TSS WRAPS recursive-proof proving keys require four artifacts (`decider_pp.bin`, `decider_vp.bin`, `nova_pp.bin`, `nova_vp.bin`) staged before the consensus node starts. These are published as a single archive (`wraps-v1.0.0.tar.gz`, ~2 GB).

The HIP external-files spec now includes an `archives:` top-level key specifically to handle this use case natively, with per-member integrity verification and atomic install.

## Dependencies

- #1084 — `archives:` parser support in `pkg/manifests`
- #537 — archive download with disk-space check
- #538 — archive install with authoritative-contents invariant and atomic staging

## Example manifest entry

```yaml
archives:
- url: "https://builds.hedera.com/tss/hiero/wraps/v1.0/wraps-v1.0.0.tar.gz"
format: "tar.gz"
algorithm: "sha256"
checksum: "abc123..."
destination: "HAPIAPP_DIR/data/keys/wraps"
phase:
download: prepare
install: freeze
contents:
- path: "decider_pp.bin"
algorithm: "sha256"
checksum: "def456..."
size: 2170538264
- path: "decider_vp.bin"
algorithm: "sha256"
checksum: "789ghi..."
- path: "nova_pp.bin"
algorithm: "sha256"
checksum: "012jkl..."
- path: "nova_vp.bin"
algorithm: "sha256"
checksum: "345mno..."
```

## Scope

Once the parser (#1084) and daemon download/install (#537, #538) support archives, this ticket covers:
- Integration testing with a real WRAPS archive
- Ensuring `tss.wrapsEnabled=true` configuration triggers the WRAPS download path
- Validating the ~2 GB download + extraction + per-member verification flow end-to-end