feat: Attested Signatures + UCAN Principal Clarification

[Peeja]

Picks up the coordinated "Attested Signatures + UCAN Principal Clarification" rollout, which merged in ucantone and the sibling repos but never got a PR here.

Dependency bumps

• github.com/fil-forge/ucantone → v0.0.0-20260702175651-12732483947f
• github.com/fil-forge/libforge → v0.0.0-20260701162346-f0706e1641a3

Code adaptation (main.go)

Under PR #30 a ucan.Signer is no longer a Principal (no .DID()); the "signer bound to a Principal" role is now ucan.Issuer, and the key packages moved from ucantone/principal/* to ucantone/multikey/*. generateSigner now returns a ucan.Issuer built via each multikey package's GenerateIssuer() helper (the pattern used across the migrated siblings — e.g. guppy's cmd/space/generate.go):

func generateSigner(name string) (ucan.Issuer, error) {
	switch name {
	case "mldsa44":
		return mldsa44.GenerateIssuer()
	case "secp256k1":
		return secp256k1.GenerateIssuer()
	}
	return ed25519.GenerateIssuer()
}

All call sites are unchanged — .DID() and passing the value as the ucan.Issuer first arg to contentcmds.Retrieve.Delegate(...) / .Invoke(...).

mldsa44 (post-quantum ML-DSA-44) is retained

ML-DSA-44 was never on ucantone main — it lived only in the unmerged PR #32 (old principal/mldsa44 layout), which is the exact ucantone commit this repo had originally pinned. Rather than drop it, it has been re-ported onto the new multikey layout in fil-forge/ucantone#37, and this PR keeps the mldsa44 branch using the new multikey/mldsa44 package.

⚠️ Pinning note: ucantone#37 is not yet merged, so this pins ucantone at that PR's unmerged commit (12732483947f) — the same kind of unmerged-commit pin this repo used before, just pointing at the new branch instead of the old one. Re-pin to a merged ucantone once #37 lands.

Verified: GOWORK=off go build ./... && go vet ./... clean; go run . emits the X-UCAN-Container blocks without panicking for both the default ed25519 path (769 B container) and the mldsa44 path (~11 kB container, consistent with ML-DSA's large signatures).

Opened as a draft for review.

🤖 Generated with Claude Code

https://claude.ai/code/session_014dZyvL474aA43c1C7E6ZpV