feat: ship hitridge-business-o1 v0.1.0 — signed depo package + toolchain

- package: manifest v1.0 (schema, package_id, layers: odoo_modules/agents/docs/config/brain)
- agents: 4 neutral cards + prompts (sellers-recruiter, test-operator, closer, compliance)
  no script.run in v0.1.0; odoo.* + file.* primitives only
- modules: aura_business_core + hitridge_venture_o1 stubs (menus, ACLs, models)
- docs: playbook, test-checklist, price-guide-starter, agreement-template.odt
- config: channels (olx-bg/forums-local), pricing-rules (BGN, A/B/C/reject, drop ladder)
- brain: empty-seed capability contract + seeds README (memories never ship)
- toolchain: depo-sign.sh (ed25519, PEM+raw), validate-depo.sh (schema/files/cards/tools/
  secrets/sig gates -> writes VALIDATE), tool-registry.json
- install.sh: target-side verify (hash + ed25519 + layer files); install is phase 2
- public-keys/depo-signing.pub committed (private key stays out of repo)
- VALIDATE: PASS (signed + verified, tamper-rejection tested)

tools/depo-sign.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# depo-sign.sh — sign a package manifest with an ed25519 key (per manifest-spec v1.0).
+# Writes, next to the manifest:
+#   <manifest>.sha256   — hex hash of manifest.json
+#   <manifest>.sig      — base64 ed25519 signature over the manifest bytes
+#
+# Usage:
+#   depo-sign.sh <package_dir> [--key <path>] [--out <dir>]
+#     --key  ed25519 private key (PEM). Default: $DEPO_SIGNING_KEY
+#     --out  where artifacts land. Default: package dir (side-by-side with manifest)
+set -euo pipefail
+
+usage() { echo "usage: $0 <package_dir> [--key <path>] [--out <dir>]"; exit 1; }
+
+PKG_DIR="${1:?missing package dir}"; shift
+KEY="${DEPO_SIGNING_KEY:-}"
+OUT=""
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --key) KEY="${2:?}"; shift 2 ;;
+        --out) OUT="${2:?}"; shift 2 ;;
+        *) usage ;;
+    esac
+done
+
+MANIFEST="$PKG_DIR/manifest.json"
+[ -f "$MANIFEST" ] || { echo "depo-sign: no manifest.json in $PKG_DIR" >&2; exit 1; }
+[ -n "$KEY" ] && [ -f "$KEY" ] || { echo "depo-sign: no ed25519 key (set --key or DEPO_SIGNING_KEY)" >&2; exit 1; }
+OUT="${OUT:-$PKG_DIR}"
+mkdir -p "$OUT"
+
+SHA="$(sha256sum "$MANIFEST" | cut -d' ' -f1)"
+printf '%s\n' "$SHA" > "$OUT/manifest.json.sha256"
+
+python3 - "$KEY" "$MANIFEST" "$OUT/manifest.json.sig" <<'PY'
+import base64, sys
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+key_path, manifest_path, out_path = sys.argv[1], sys.argv[2], sys.argv[3]
+data = open(key_path, "rb").read()
+try:
+    key = serialization.load_pem_private_key(data, password=None)
+except ValueError:
+    key = Ed25519PrivateKey.from_private_bytes(data)  # raw 32-byte fallback
+if not isinstance(key, Ed25519PrivateKey):
+    raise SystemExit("depo-sign: key is not an ed25519 key")
+manifest = open(manifest_path, "rb").read()
+sig = key.sign(manifest)
+open(out_path, "wb").write(base64.b64encode(sig))
+PY
+
+echo "depo-sign: signed $MANIFEST"
+echo "  sha256  $OUT/manifest.json.sha256"
+echo "  sig     $OUT/manifest.json.sig"