Create policy-gated WSCD digest signature

Signs a precomputed digest with a Wallet Unit WSCD key after the same lifecycle and activation-decision checks as raw signing. This endpoint is intended for flows that already compute the operation digest before invoking the Wallet Unit WSCD policy layer.