feat: add load_ucp_signing_key_from_env helper

[vvillait88]

Summary

• Env-driven UCP signing-key loader with concurrent-safe caching. Reads `UCP_SIGNING_KEY_JWK_PRIVATE`, validates kty/crv (OKP+Ed25519 or EC+P-256), projects to canonical public JWK. Falls back to ephemeral keypair when absent.
• Largest single lift of TEC-302: replaces 3 structurally identical implementations (~385 lines combined across store/lib/ucp_signing.py, martin/lib/ucp-signing.ts, signed_ucp_merchant.py inline).
• Cache keyed by full options tuple — merchants running multiple keys from different env namespaces don't collide.
• Error messages sanitize underlying joserfc exceptions; key bytes never leak to logs.

Behavior contract

• Embedded `kid` in JWK wins over env `kid`; empty-string falls through to default.
• Structural `kty`+`crv` wins over env alg.
• Whitespace-only env var treated as absent (handles xargs-newline footgun).
• Case-insensitive env alg comparison.
• Concurrent first-callers share cached result (threading.Lock-protected).

Tests

• 22 locked behavior contracts shared with the `@agent-score/commerce` sibling.
• Env-load happy paths (Ed25519 + ES256), kid precedence, unknown-field stripping, ephemeral fallback, whitespace handling, malformed-input errors, sanitized-error invariant, caching identity, concurrent-call safety, env-var override.

Test plan

• `uv run pytest tests/test_load_ucp_signing_key_from_env.py` — 22 tests pass
• `uv run pytest` — full suite 1024 pass / 3 skip, coverage 95.24%
• `uv run ruff check`, `uv run ruff format --check`, `uv run ty check` — green

🤖 Generated with Claude Code