Pin production badge issuer key (bdg-v1)

[TeoSlayer]

Replaces the all-zero placeholder in the badge issuer keyring with the production public key (kid bdg-v1), so badges signed by the Cloud KMS issuer key actually verify offline. This is what makes a "verified" mark possible.

• The pinned value is the public key (Y2jjSAS…); the private half lives only in Cloud KMS (EC_SIGN_ED25519, key ring pilot-badges/badge-issuer). Public keys are meant to be embedded in every verifier — same pattern as internal/catalogtrust. Still ldflags-overridable for rotation.
• Recovery keyring untouched — rec-v1 stays an all-zero placeholder (cold custody, still blocked); added a test that locks that in.

Tests

• TestPinnedIssuerGoldenVector: a real gcloud kms asymmetric-sign signature over a canonical badge verifies against the pin (vector baked in — no KMS access at test time), and honors the node-binding rule.
• TestIssuerKeyPinned: the pinned key is present + non-zero; a foreign-signed badge under bdg-v1 is rejected with ErrBadSignature (real verify runs, not a fail-closed ErrNoKey).
• TestRecoveryKeyStillPlaceholderFailsClosed: recovery stays disabled.
• go test -race ./... green (15 pkgs); gofmt clean. Replaces the now-obsolete TestPlaceholderKeyFailsClosed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!