feat(prs-556): enforce ABI trust posture in tvc-deploy and grpc-server

[pepe-anchor]

Replaces #443, which GitHub closed as merged when it was merged into its parent
stack branch instead of being rebased.

Why am I making this PR?

The deploy-time posture must be enforced at the tooling layer too: tvc-deploy should validate and sign the chosen posture into the manifest, and grpc-server should document its default.

What am I changing?

tvc-deploy: require a posture (unsigned or hex secp256k1 pubkey), validate the pubkey on-curve before writing it into the signed manifest, append the flag to pivotArgs for auditability. grpc-server: take the same flags but default to accept-unsigned (non-attested dev server) with a startup log line. CI workflows pass --accept-unsigned-abis explicitly.

One change from the original #443: the grpc-server call-site update for the new
parse(req, key, &ParserConfig) signature now lands in the parser_app commit below,
which is where the signature actually changes. #443 left grpc-server uncompilable
between the two commits. This PR keeps only the cmdline-flag work for grpc-server.

What is the Linear ticket?

PRS-556

What are the rollback steps?

Revert the commit and redeploy with manifest pivotArgs that omit the new flag.

Is this change backwards compatible?

tvc-deploy now refuses to build a manifest without a posture. CI workflows updated to pass explicit posture.

Does this require cross-team/service coordination?

Yes, deployments need a redeploy to pick up an explicit posture.

How do I know it works as designed? Which tests exercise this code?

tvc-deploy unit tests cover key validation (format, on-curve, off-curve) and XOR posture enforcement.

Verified at this commit: cargo clippy --all-targets -- -D warnings clean.