Create policy-gated wallet-key digest signature

Signs a precomputed digest with a Wallet Unit key after the same lifecycle and activation-decision checks as raw signing. This endpoint is intended for flows that already compute the operation digest before invoking the Wallet Unit KMS policy layer.