BYOC: requires Eth keystore in -network offchain mode

Nobody has claimed this yet.

## Problem

BYOC's discovery handshake (`getJobSender` in `byoc/job_gateway.go`, signature verification in `byoc/job_orchestrator.go`) signs and verifies an ECDSA signature unconditionally. In `-network offchain` mode this still requires `-ethPassword=...` on both gateway and orchestrator to auto-generate a throwaway keystore that exists solely to satisfy the signing API.

This conflicts with the offchain semantic ("no chain, no crypto") and creates friction for local BYOC testing. Without `-ethPassword` the call to `/process/token` fails with:

```
[orchestrator] Unable to hex-decode signature: invalid byte: U+0078 'x'
[gateway] Failed to get token from Orchestrator
[gateway] No orchestrators found for capability
```

## Root cause

Both halves of the signing flow are *already* offchain-aware:

- `core/broadcaster.go:14` — `Sign()` returns `[]byte{}, nil` when `node.Eth == nil`.
- `core/orchestrator.go:66` — `VerifySig()` returns `true` when `node.Eth == nil`.

But BYOC's wrapper code prevents that bypass from being reached:

1. `byoc/job_gateway.go:447` — `getJobSender` always prefixes the encoded signature with `"0x"`, producing the literal string `"0x"` when the underlying signature is empty bytes.
2. `byoc/job_orchestrator.go:597-604` — `verifyTokenCreds` only strips the `"0x"` prefix when `len(Sig) > 130`. Shorter strings pass through to `hex.DecodeString` unchanged, which then fails on the `"0x"` and aborts before the offchain-aware `VerifySig` is called.

End result: BYOC users have to add `-ethPassword=...` to both nodes purely to satisfy a vestigial signing requirement. The keystore has no balance, signs nothing meaningful, and exists only because of these two lines.

## Proposed fix

- `byoc/job_gateway.go`: emit empty `Sig` (`""`) when the broadcaster has no signature to provide.
- `byoc/job_orchestrator.go`: trim the `"0x"` prefix unconditionally (current length-gated trim is brittle); empty sig then decodes to empty bytes, and the existing `VerifySig` offchain bypass takes over.

After the fix a BYOC stack can run with just `-network offchain` on both gateway and orchestrator — no `-ethPassword`, no auto-generated keystore, no `-ethUrl`. Matches transcoding's existing offchain story.

## Context

Surfaced while building a Pipeline SDK hello-world test against unmodified go-livepeer ([livepeer-python-gateway examples/runner/hello_world](https://github.com/livepeer/livepeer-python-gateway)). The compose currently includes `-ethPassword=secret-password` as a workaround pointing at this issue.

## PR

Fix in [#PR — to be linked].

Start in byoc/job_gateway.go at getJobSender and byoc/job_orchestrator.go at verifyTokenCreds, then read core/broadcaster.go:14 and core/orchestrator.go:66 to understand the existing offchain bypass. Ensure offchain BYOC emits and accepts an empty signature without requiring an Ethereum keystore, and verify the described gateway-to-orchestrator token flow.

Written by the indexing model from the issue text.