audit-D16: operator key must never be an agent identity

Background: CAYCE_OPS_OPERATOR_PUBKEY was set to Cayce nostr pubkey —
Cayce was approving itself. Signature was technically valid but semantically
null: human approval signed by the agent is not human approval.

- signing.py: validate_no_self_approval() rejects the operator pubkey when
  it matches (a) the pubkey derived from any private key in the config,
  or (b) any pubkey in CAYCE_OPS_FORBIDDEN_OPERATOR_PUBKEYS deny-list.
- executor/maild/publisher _signing() now calls the validation, so every
  daemon and every CLI approve-* path refuses to operate (D16).
- tests: 6 new (agent-key refusal, human key passes, empty passes,
  explicit denylist, end-to-end daemon refusal, derivation roundtrip).
- docs/DECISIONS.md: D16.

The operator signature is now produced OUTSIDE the VPS. CAYCE_OPS_OPERATOR_PUBKEY
must stay empty until the external signer exists — daemons refuse, which is
correct. The Cayce nsec itself is NOT touched (still the agent identity for
publishing and anchoring).

tests/test_maild.py

@@ -311,7 +311,9 @@ def test_send_failure_does_not_resurrect_sent_mails(cfg, sess):
             p.id, f"desk{i}@acme.example.org", f"[cayce] inquiry {i}", "Hello!", sess
         )
         assert (
-            maild._approve_draft(mail_id, "operator", sess, signature=_approve_signed(sess, mail_id))
+            maild._approve_draft(
+                mail_id, "operator", sess, signature=_approve_signed(sess, mail_id)
+            )
             == 0
         )
         assert maild._send_one(STUB_CFG, sess, mail_id, sender=lambda *a, **k: None) == "sent"