audit-D16: operator key must never be an agent identity

Background: CAYCE_OPS_OPERATOR_PUBKEY was set to Cayce nostr pubkey —
Cayce was approving itself. Signature was technically valid but semantically
null: human approval signed by the agent is not human approval.

- signing.py: validate_no_self_approval() rejects the operator pubkey when
  it matches (a) the pubkey derived from any private key in the config,
  or (b) any pubkey in CAYCE_OPS_FORBIDDEN_OPERATOR_PUBKEYS deny-list.
- executor/maild/publisher _signing() now calls the validation, so every
  daemon and every CLI approve-* path refuses to operate (D16).
- tests: 6 new (agent-key refusal, human key passes, empty passes,
  explicit denylist, end-to-end daemon refusal, derivation roundtrip).
- docs/DECISIONS.md: D16.

The operator signature is now produced OUTSIDE the VPS. CAYCE_OPS_OPERATOR_PUBKEY
must stay empty until the external signer exists — daemons refuse, which is
correct. The Cayce nsec itself is NOT touched (still the agent identity for
publishing and anchoring).

cayceops/components/publisher/publisher.py

@@ -118,13 +118,20 @@ GATE_ERROR = 2  # missing/invalid configuration or signature
 
 
 def _signing(cfg: Config) -> tuple[str, str]:
+    """(deployment_id, operator_pubkey) or ConfigError. No degraded mode.
+
+    Also rejects the agent's own identity as operator (D16): the operator
+    key must belong to a human and must never reside on this server.
+    """
     from cayceops.config import ConfigError
+    from cayceops.signing import validate_no_self_approval
 
     if not cfg.operator_pubkey or not cfg.deployment_id:
         raise ConfigError(
             "approvals disabled: CAYCE_OPS_OPERATOR_PUBKEY and "
             "CAYCE_OPS_DEPLOYMENT_ID are both required"
         )
+    validate_no_self_approval(cfg)
     return cfg.deployment_id, cfg.operator_pubkey