Pin the v1 wire-format fixtures with worked-example signatures

[sanity]

Problem

freenet-git-encoding has worked-example tests that lock the byte format of length-prefixed signed payloads and canonical CBOR for bundle ids. The ref-update fixture currently asserts that signing+verifying works, but does not pin the resulting ed25519 signature bytes against a known test key.

Pinning the signature bytes makes the wire format binding for any independent implementation: a Go or TypeScript port that produces a different signature for the same logical inputs immediately fails the cross-implementation conformance suite.

What needs to happen

In crates/encoding/src/signed.rs, ref_update_signs_and_verifies test:

• Compute the actual signature once and lock it as a hex constant.
• Add the same fixture for the object-bundle and string-field signed payloads.
• Move them into a fixtures.rs module documented as "the wire-format pin."

A change in any of those expected hex constants is a wire-format break and must come together with a v1 -> v2 domain bump.

[AI-assisted - Claude]

[sanity]

Status check 2026-05-01: still relevant.

Update: the ChunkedPack manifest format (added in 0.1.1) DID land with a worked-example fixture pinning the manifest bytes + BLAKE3 hash — see crates/types/src/chunked.rs::manifest_wire_format_fixture. The pattern is now established; this issue just extends it to the signed-payload module (crates/encoding/src/signed.rs).

Concrete next step: in ref_update_signs_and_verifies, compute the signature once with the fixed test key, paste the hex as a constant, and replace the loose round-trip with an exact byte assertion. Same for object-bundle and string-field payloads.

[AI-assisted - Claude]