feat(cli): add native xmlsec1 command surface

[polaz]

Problem

The library exposes XMLDSig and XMLEnc pipelines, but cannot be used as a drop-in command-line replacement by existing libxmlsec1 automation. Upstream test scripts currently require the C xmlsec1 executable or a translation layer, so command compatibility and end-to-end coverage are not measured against the Rust implementation.

Scope

• Add a native xmlsec1-compatible Rust binary for signing, verification, encryption, decryption, key handling, and capability queries.
• Preserve the upstream command aliases, option syntax, output routing, and process exit-status contract for the implemented surface.
• Drive operations through the existing provider, policy, XMLDSig, and XMLEnc APIs without a second cryptographic implementation or implicit resource access.
• Advertise only capabilities that complete end-to-end; unsupported formats and algorithms must fail capability checks cleanly.
• Run the unmodified upstream testDSig.sh, testEnc.sh, and testKeys.sh scripts against the Rust binary without a Python translation layer.
• Reconcile command, option, status, transform, and key-data results with the compatibility ledger.
• Document installation, supported CLI behavior, limitations, and representative usage.

Acceptance criteria

• Sign/verify and encrypt/decrypt round trips work through the process interface.
• Wrong keys, tampered data, malformed XML, invalid options, unsupported capabilities, and output failures return deterministic non-zero statuses.
• Capability queries and runtime behavior are sourced from the same registry and cannot contradict each other.
• Unit, process integration, donor interoperability, doctest, clippy, and all-feature workspace checks pass.

Validation

• cargo nextest run --workspace --all-features
• cargo test --workspace --all-features --doc
• cargo check --workspace --all-targets --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings

[coderabbitai]

🔗 Related PRs

#41 - test(xmldsig): add donor full verification suite accounting [closed]
#88 - feat(xmldsig): cover donor signing templates [merged]
#96 - feat(xmlenc): add encryption pipeline [merged]
#103 - feat(xmldsig): complete transform coverage [merged]
#111 - build: add libxmlsec capability ledger [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!