RFC 7517 JWKSet (discovery-only)

JSON Web Key Set (RFC 7517) form of the active Ed25519 signing key for JOSE-aware verifiers. Single-key set; each key carries an RFC 7638 thumbprint as kid. Discovery-only in this release — receipts do not yet carry kid, so deployed SDKs continue to verify against /.well-known/oracle-keys.json (hex public_key). kid-aware receipt verification is planned for a future major release. Content-Type: application/jwk-set+json. Cache-Control: public, max-age=300.