Publish the atproto signing key in resolveMiniDoc's document

[germ-mark]

Slingshot returns signing_key on the wire but resolveMiniDoc's
Atproto.DIDDocument adapter discarded it, shipping verificationMethod: [].
So a repo proof checked against a Slingshot-resolved document failed for want
of a key — nondeterministically, since germ-atproto-resolver's
optimizedResolve races this resolver against plc.directory and either can
win.

The published method is spelled the way plc.directory spells it — fully-
qualified did:...#atproto id, Multikey, self-controlled — verified against
a live document, not the ticket's suggested bare #atproto fragment. Both
forms satisfy RepoSigningKey's matcher, but a consumer holding the result
shouldn't be able to tell which resolver produced it; MiniDocDocumentTests
pins the fully-qualified shape directly, not just what the matcher happens to
accept.

MiniDocDocumentTests takes a test-only dependency on AtprotoTypesVerify to
prove the published key actually round-trips through the downstream verifier's
matcher (fragment, controller, multibase), not just that the field is
populated — a shape-only assertion would pass even if any of the three were
subtly wrong. Confirmed by reverting the fix locally: the test fails with
exactly .noAtprotoSigningKey. The added dependency pulls in nothing new
(swift package show-dependencies is unchanged) — AtprotoTypesVerify's
secp256k1 port does ship in that product and this test target now links it,
but it's pure Swift; the only extra dependency it could have pulled in
(swift-secp256k1, a differential-testing oracle) is confined to AtprotoTypes'
own test target and isn't linked here.

Draft: gated on AtprotoTypes germ-network/AtprotoTypes#60. The floor is
already bumped to 0.5.1 (the release that will make VerificationMethod.init
public) but that version doesn't exist yet, so Package.resolved is
deliberately left untouched at its current pin and CI will fail to resolve
dependencies until #60 merges and releases. Once it does: confirm the real
tag, swift package update AtprotoTypes, commit the resulting
Package.resolved, mark ready for review. To reproduce the new tests locally
before then, override with a local path: swift package edit AtprotoTypes --path <checkout of #60>.

Part of GER-2268.

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 8d53136

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@germ-network/microcosm	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR