raco rivet sign-manifest: fold the signed-feed assembly into the CLI (two private implementations exist) #243

Products assemble + sign + self-verify the release manifest two different ways today:

• taskly scripts/make-update-manifest.sh: bash + OpenSSL PEM->DER conversion + manual sha256 sidecars
• fulcrum .github/sign-manifest.rkt: Racket + rivet/distribution DER directly

Same flow, same wire format, two implementations to keep compatible. Proposal: raco rivet sign-manifest --base-url <url> --key-id <id> --private-key <der|pem> which builds the manifest from a dist directory, signs it via distribution's own signer, verifies with the public half before writing, and (optionally) emits the sha256 sidecars — products keep only their asset-naming conventions.

This also de-risks key handling: the CLI can enforce fail-closed behavior (refuse to publish unsigned) uniformly instead of each script reinventing the guard.