Create policy-gated wallet-key raw signature

Signs raw input with a Wallet Unit key after lifecycle, account status, key-reference policy, and activation-decision checks. The activation decision must be accepted, unexpired, unconsumed, and bound to the exact operation type, hash, nonce, and audience in this request.