guardian: Bind log signatures to S3 object keys

[mskd12]

Summary

• bind each signed guardian log to its canonical S3 object key
• preserve actual S3 keys through batch and point reads for verification
• retain authenticated key provenance in VerifiedLogRecord
• validate unsigned OI attestation placement and session derivation
• add replay and key-derivation tampering coverage

Testing

• cargo test -p hashi-types guardian::log::envelope::tests
• cargo test -p hashi-guardian
• cargo test -p hashi-guardian-proxy
• cargo clippy -p hashi-types -p hashi-guardian -p hashi-guardian-proxy --all-targets -- -D warnings

IOP-494