feat(round): sign reads of the submission feed

[ai-hpc]

Validator half of F1 from the v2 audit. Pairs with the backend PR closing its read endpoints.

/v2/submissions carries every miner's PoC bytes. It is now validator-signed, and this client signs the fetch with the same hotkey that posts the results back.

The timestamp is the load-bearing part

cybergym:v2:read:/v2/submissions:3:1700

Path, round, and moment. Without the timestamp a captured header is a permanent credential — a GET replays verbatim for anyone who observed it once, which is the difference between a signature and a bearer token.

What stays public

The clock, the run limits, the task handles and the aggregate results. A miner is entitled to know the schedule it is racing, the budget it is held to, how many tasks it is scored out of, and what everyone scored. Signing those would imply a gate that is not there — a test asserts public reads send no headers.

Unsigned remains a working dry-run mode: the client sends no headers rather than fabricating a signature.

read_message is duplicated from the backend deliberately, as the write messages already are — the repos cannot import each other on the payout path, so the agreement is pinned as a byte literal in tests on both sides.

119 v2 tests pass; ruff clean.

[ai-hpc]

Self-review before merge (owner-directed; posted for post-merge audit)

All seven checks pass.

What I checked: the read message binds path, round AND timestamp — the timestamp being the part that separates a signature from a bearer token, since a GET replays verbatim for anyone who observed it. Only the submission feed is signed; a test asserts public reads send no headers, because signing them would imply a gate that is not there. Unsigned stays a working dry-run mode and sends nothing rather than fabricating a signature. The client/backend agreement is pinned as a byte literal in tests on both sides, as the write messages already are.

Pairs with cathedral-cybergym-backend#35, which is the half that actually refuses.