* fix(witness): support pinned signing keys and label legacy signatures
The default witness seed is derived from the public git commit, so anyone can re-sign a modified manifest; verify.mjs still called the result cryptographically valid. Add RUFLO_WITNESS_SEED for external-key signing and RUFLO_WITNESS_PUBLIC_KEY for pinned verification (fail closed on external-key manifests without a pin), tag legacy manifests as self-attested, and stop describing the default as authorship proof.
* fix(witness): make --public-key win over the env pin
The env-var precedence audit requires a CLI flag for RUFLO_WITNESS_PUBLIC_KEY. Add --public-key, document that it takes precedence, and cover both precedence directions in the auth test.
* fix(ci): exclude witness-auth test from vitest ratchet (uses node:test)
plugins/ruflo-core/scripts/witness/__tests__/witness-auth.test.mjs imports
from node:test, not vitest, matching the same miscategorization pattern as
pod-tick.test.mjs and probe-mod-guards.test.mjs. vitest's glob picks it up
but can't parse node:test's API, so the ratchet reports "No test suite
found" even though `node --test` passes all 3 cases cleanly.
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
Co-authored-by: RuFlo <ruv@ruv.net>
