Create policy-gated WSCD raw signature

Signs raw input with a Wallet Unit WSCD key after lifecycle, account status, key-reference policy, and activation-decision checks. The activation decision must be accepted, unexpired, unconsumed, and bound to the exact operation type, hash, nonce, and audience in this request.