Add guardian signing CLI and documentation

[MontrealAI]

Summary

• add a Dilithium signing CLI plus shared helpers so guardians can emit deterministic envelopes without hand-scripting
• document the guardian flow, refresh the Mode A runbook, and surface the new tooling in the README badges/table
• cover the new helpers with vitest to keep the ABI and CBOR layers verifiable

Testing

• npm test
• npm run test:frontend

---

Codex Task