fix: export per-site signing key instead of legacy slot

[sanity]

Problem

Users reported that edits to imported sites don't persist after refresh — including on the same node after export → remove → re-import. The imported site was readable but every edit silently reverted on refresh.

Root cause

DelegateRequest::GetSigningKey carried no prefix, so the delegate handler called load_signing_key(ctx, None). With None, load_signing_key skips per-prefix storage and reads only the legacy delta:signing_key slot. When any legacy key was present (leftover from V1–V4 or from another site migration), export silently returned that unrelated key paired with the current site's owner_pubkey. The resulting token's signing_key and owner_pubkey were mismatched, so every signed page/config/deletion on the importing side failed the contract signature check on the network and UPDATEs were dropped. Optimistic local updates hid the failure until the next refresh fetched the unchanged network state.

This explains all three Matrix bug reports:

• Export from node A → import on node B → B's edits don't stick (wrong key in token)
• Export → remove → re-import → viewable but not updatable (same mechanism)
• Same-node re-import wipes the correct per-prefix key with the wrong legacy one

Approach

1. Add prefix: Option<String> to DelegateRequest::GetSigningKey and pass it through to load_signing_key, which already prefers the per-prefix slot.
2. request_export passes the currently-selected site's prefix.
3. Defence in depth: handle_signing_key_response verifies the returned key's public key matches the site's owner_pubkey before emitting a token. If they don't match, we show an explicit error instead of silently producing a broken token. Turns any future regression of this bug into a loud failure.
4. Gate the export response handler on SHOW_EXPORT, so the legacy-migration code path (which still issues GetSigningKey { prefix: None } to probe pre-V7 delegates) can't spuriously populate export state.
5. Legacy migration keeps prefix: None — that's the correct probe against pre-V7 delegates where the legacy slot is the only place a key can live.

Testing

• New CBOR round-trip regression test (get_signing_key_request_roundtrips_with_prefix) guarding the wire format so a future refactor can't silently drop the prefix again.
• cargo test -p delta-core — 18/18 passing.
• cargo fmt + cargo clippy --workspace --all-targets clean.
• ./scripts/check-migration.sh confirms the V7 migration entry was captured before the delegate code change.

Migration

Adds legacy_delegates.toml entry V7 captured before the delegate code change via ./scripts/add-migration.sh, so users whose signing keys live in the pre-V7 delegate still migrate to the new delegate on next load. Per AGENTS.md delegate upgrade workflow.

Why CI didn't catch this

There are no integration tests exercising the real delegate through the UI's export/import round trip — the existing tests cover state signing and CBOR round-trips in delta-core, but the delegate's storage behavior under prefix: None vs Some(_) was untested. The new CBOR round-trip test narrows this gap for GetSigningKey specifically; a broader follow-up would exercise the delegate binary end-to-end.

Closes the edit-after-import bug class reported on Matrix.

[AI-assisted - Claude]

[sanity]

Addressed review feedback in dae126d:

Code-first + Skeptical (critical): wire-format break. Reverted to keeping GetSigningKey as a unit variant (for CBOR wire compat with pre-V7 delegates, so legacy-migration probes keep working) and added a new GetSigningKeyForPrefix { prefix: String } variant that only V7+ delegates understand. Added a wire-format regression test asserting GetSigningKey still serializes as a bare text string.

Skeptical: response correlation race. Added a PENDING_EXPORT signal holding a snapshot of the target site at request time. The response handler is now keyed off the snapshot, not current_site(), so a concurrent legacy-migration SigningKey response or a user-initiated site switch can no longer produce spurious owner_pubkey mismatches.

Skeptical: visitor sites. request_export now rejects SiteRole::Visitor up front with a clear error.

Code-first: silent hang on current_site() is None. The whole response path is now driven by PENDING_EXPORT; if that's not set, the response is simply ignored (it was a legacy-migration probe). If the user hits Export with no site selected, they get an explicit "No site selected to export." error.

Testing (critical): extracted select_key_bytes from load_signing_key in the delegate and added 4 unit tests directly exercising the pre-V7 bug condition (per-prefix vs legacy priority with both populated, both empty, each singly populated). Also extracted validate_signing_key_matches in the UI and added 3 unit tests for the defence-in-depth guard (accept matching, reject mismatched, reject malformed length).

Big-picture: the site_contract.wasm hash does change (b92da83d → 53e3395f) because common/ rebuilt. The existing WASM upgrade path handles this automatically (stored contract_key vs computed → GET old, PUT new). Delegate migration V7 entry is unchanged.

All tests passing locally: delta-core 19/19, site-delegate 4/4, delta-ui 3/3, clippy clean.

[AI-assisted - Claude]