Add CAUSALLAYER_ISSUER_KEYS env override for runtime key rotation

[smq9sn5jck-coder]

Summary

Adds an env-var seam so issuer keys can be added or rotated without a redeploy. Keys supplied via CAUSALLAYER_ISSUER_KEYS (a JSON array of IssuerKey) are merged over the resolved registry — remote or pinned — overriding any registry key with the same key_id.

This mirrors the ISSUER_PUBLIC_KEYS override already present in faultkey-cert-worker, keeping the two verification surfaces (the worker that stores certs and the verifier that validates them) consistent in how operators manage trust.

Why

• Operational: rotating or introducing an issuer key currently requires shipping a new pinned registry / redeploy. The override makes it a config change.
• Testability: gives tests a clean seam to register a freshly generated key, rather than mocking the network fetch.

Tests (vitest, on top of the existing suite)

• A key known only through CAUSALLAYER_ISSUER_KEYS passes both issuer-trust and signature verification (with remote + pinned registries deliberately unaware of it).
• A malformed override value is ignored without throwing (issuer trust simply fails, pipeline completes).

27/27 tests pass; tsc build clean.

Context

This is the one net-new piece carved out of the now-closed #10. The Ed25519 verification fix and round-trip test coverage that #10 also carried already landed on main via #8, so only this override remained.

https://claude.ai/code/session_01VrsSvG4PemnPeHzMcCuZC9

---

Generated by Claude Code