feat(prism): emit ExecutionProof in work-unit result payload (M3 prism-proof)

Add src/prism_challenge/proof.py: ExecutionProof v1 envelope (schema-compatible
with the base worker plane), canonical manifest hashing (sha256 over
json.dumps(manifest, sort_keys=True, indent=2) == the exact on-disk bytes of
prism_run_manifest.v2.json), tier computation from injected provider env
(tier 0 default; tier 1 needs BOTH image digest AND pod metadata; tier 2 only
with a non-null attestation payload), and an sr25519 worker signature over the
pinned message sha256(f'{manifest_sha256}:{unit_id}') (identical to the base
agent, VAL-AGENT-008/VAL-PRISM-006).

Wire emission into the validator finalization path: the dispatch result payload
carries exactly one signed proof at successful finalization, gated on a new
prism worker_plane config block (enabled by default OFF -> legacy behavior).
Proof construction reads only the manifest + a fixed non-secret provider env
allowlist and never the held-out split config or LLM keys (VAL-PRISM-008).

Fulfills VAL-PRISM-001/002/003/004/005/006/008.

Author: echobt

src/prism_challenge/config.py

@@ -3,17 +3,43 @@
 from pathlib import Path
 from typing import Literal
 
-from pydantic import AliasChoices, Field
+from pydantic import AliasChoices, BaseModel, Field
 from pydantic_settings import SettingsConfigDict
 
 from .sdk.config import ChallengeSettings
 
 
+class WorkerPlaneConfig(BaseModel):
+    """Prism worker-plane feature block (architecture.md 3.4/3.5).
+
+    OFF by default: with ``enabled`` false prism behaves exactly as before the compute plane (no
+    ExecutionProof emission, no admission gate, legacy audit-free finalization). Env overrides use
+    the nested delimiter, e.g. ``PRISM_WORKER_PLANE__ENABLED=true``.
+    """
+
+    enabled: bool = False
+    admission_requires_worker: bool = False
+    audit_rate_tier0: float = Field(default=0.10, ge=0.0, le=1.0)
+    audit_rate_tier1: float = Field(default=0.05, ge=0.0, le=1.0)
+    audit_rate_tier2: float = Field(default=0.02, ge=0.0, le=1.0)
+    # sr25519 signing key (URI ``//Name`` / mnemonic / seed) for the worker that emits
+    # ExecutionProofs. This is the worker's OWN key, injected by the worker agent -- NEVER a
+    # master-side secret. Unset -> prism emits no signed proof (the base worker plane may still
+    # stamp a tier-0 proof from the manifest hash).
+    signing_key: str | None = Field(default=None, repr=False)
+
+
 class PrismSettings(ChallengeSettings):
     model_config = SettingsConfigDict(
-        env_prefix="PRISM_", env_file=".env", extra="ignore", populate_by_name=True
+        env_prefix="PRISM_",
+        env_file=".env",
+        extra="ignore",
+        populate_by_name=True,
+        env_nested_delimiter="__",
     )
 
+    worker_plane: WorkerPlaneConfig = Field(default_factory=WorkerPlaneConfig)
+
     database_url: str = Field(
         default="sqlite+aiosqlite:////data/prism.sqlite3",
         validation_alias=AliasChoices("PRISM_DATABASE_URL", "CHALLENGE_DATABASE_URL"),