Enforce Lumera HRP for supernode signer identity

[akobrin1]

This PR ensures supernode SDK always uses Lumera bech32 addresses for secure transport identities and signer defaults, independent of global SDK config.

• Added GetBech32Address helper in supernode/pkg/keyring with unit test.
• Use Lumera HRP in factory.go.
• Use Lumera HRP in impl.go with injectable newClientCreds; add test to verify LocalIdentity.
• Use Lumera HRP in client.go with injectable newLumeraAdapter; add test to verify signerAddr normalization.
• validateDownloadAction now accepts ACTION_STATE_APPROVED in addition to ACTION_STATE_DONE - so that approved actions can be downloaded as well.

[roomote]

Rooviewer   See task on Roo Cloud

Reviewed all 9 changed files. No issues found.

The PR correctly enforces Lumera HRP for supernode signer identity across all SDK components with good test coverage.

_{Mention @roomote in a comment to request specific changes to this pull request or fix all unresolved issues.}