feat(agent-readiness): Web Bot Auth — publish /.well-known/http-message-signatures-directory + sign seeder fetches (honest-crawler fix for #3799)

Telnyx-parity review (2026-07-06). Telnyx serves a Web Bot Auth directory at /.well-known/http-message-signatures-directory with 1 Ed25519 JWK (kty=OKP, crv=Ed25519, kid, nbf, exp) and passes the emerging-check. We 404.

Two-sided value:

1. Origin side (cheap): publish the directory so the emerging check and future agent-verification flows resolve.
2. Crawler side (the real win): #3799 flagged that our Railway seeders reach OREF/corridor-risk sources by spoofing browser headers. Web Bot Auth (HTTP Message Signatures, RFC 9421 + the bot-auth draft) is the principled alternative: sign outbound seeder requests with an Ed25519 key, publish the public key in our directory, send a descriptive UA — origins can then verify us instead of us impersonating Chrome. Cloudflare already verifies WBA signatures, and several of our upstream sources sit behind Cloudflare.

Scope: key generation/rotation story (nbf/exp), directory file (static, .well-known already excluded from the SPA catch-all), signing middleware in the seeder fetch path, opt-in per source.

Read RFC 9421 and the bot-auth draft, then trace the seeder fetch path and the existing .well-known handling. The work is complete when the directory, key generation and rotation story, signed outbound fetches, descriptive user agent, and per-source opt-in are implemented without browser-header spoofing.