Build runnable Q-Cap MVP with revocations

[edip-dev-01]

Summary

• Adds a runnable Q-Cap MVP flow with identity generation, sealed .qcap packages, capability grants, open/verify/inspect, and registry publish/fetch.
• Adds GeoPackage demo fixture generation and verifies exported GeoPackage bytes.
• Adds signed revocations.json support, qcap revoke, open --revocations enforcement, token-protected registry publishing, and persistent registry index.json.
• Updates docs/demo scripts to match the current MVP behavior and avoid claiming Argon2id-protected keyfiles before that exists.

Issue coverage

Addressed in this fork:

• Implement BLAKE3 Merkle tree (#core-001) #2 BLAKE3 payload Merkle tree
• AEAD XChaCha20-Poly1305 envelope encryption (#core-002) #3 XChaCha20-Poly1305 envelope encryption
• ed25519 signing & verification (#core-003) #4 ed25519 signing and verification
• .qcap writer/reader (ZIP/TAR+GZ) (#core-005) #6 .qcap ZIP writer/reader layout
• Revocations format & parser (#core-007) #8 revocations format and parser
• qcap init (#cli-001) #10 qcap init
• qcap seal (#cli-003) #12 qcap seal
• qcap revoke (#cli-006) #15 qcap revoke
• qcap publish/fetch (#cli-008) #17 qcap publish/fetch

Partially addressed:

• Auth: OIDC admin + PAT (#srv-005) #23 bearer-token protection for publish endpoints is implemented; OIDC admin is still pending.

Not claimed:

• Revocations endpoint (#srv-006) #24 revocations endpoint is not implemented yet; revocation files are local/CLI-enforced in this PR.

Verification

• cargo fmt
• cargo check
• gofmt
• go test ./... in services/qcap-registry

Note: cargo test builds but this Windows machine blocks Rust test binary execution with Application Control policy error 4551, so full Rust test execution could not be completed locally.