[jeffreyaven]

Summary

• Verify embedded raw-v1 ML-DSA-65 signatures at every registry document read using the shared signing module from ml-dsa-provider-signatures stackql-provider-registry#487.
• Remove Ed25519/X.509 and .sig fetching; invalid embedded documents cannot fall back to legacy signatures.
• Preserve nopVerify and existing default behavior. Explicit publicKeys replaces the embedded roots for private registries.
• Parse the exact authenticated payload. Correct Windows file-URL handling consistently for document reads and version discovery.

Validation

• Local/cache/HTTP signature tests: valid, tampered, unknown key, missing signature, opt-out, and no sidecar fetches.
• Registry and provider-pull regressions, discovery/address-space tests, and complete Go build pass without a local module replacement.
• StackQL's six new Robot signature scenarios pass against both SDK paths.
• Explicit go vet also reports two existing malformed YAML tags in registry metadata structs; these unrelated pre-existing tags are unchanged.

Tagged release and coordination

Release v0.6.1-beta02 tags the single squashed feature commit e35c9de. It pins signing v0.1.0-alpha01 instead of a feature-commit pseudo-version. Public module resolution, tidy, focused registry/signature tests and the complete build pass.

MERGE METHOD: CREATE A MERGE COMMIT. Do not squash or rebase this PR: preserve the exact tagged commit in main history. After merging, verify git merge-base --is-ancestor v0.6.1-beta02 origin/main succeeds. Never move a published tag; fixes require a new prerelease and downstream CI.

Order: provider-tests stackql/stackql-provider-tests#2 first; this PR and stackql-labs/omnisdk#23 in parallel; then squash-merge stackql/stackql#869 and publish the new binary; finally merge stackql/stackql-provider-registry#487 with a merge commit. Confirm the provider-test latest-binary download receives the new build before registry cutover. The approved raw-v1 protocol and opt-in defaults are unchanged.

Latest semver CI verification

All PR checks passed at tagged commit e35c9de, including Linux/Windows/macOS builds and tests: https://github.com/stackql/any-sdk/actions/runs/40050519071. All downstream core checks passed with the named versions: https://github.com/stackql/stackql/actions/runs/40050605476. Required maintainer approval remains. No PRs have been merged; use Create a merge commit to bring the release tag into main history.

Closes #153

[jeffreyaven]

Coordinated cutover is ready and core #869 is approved. This library PR has all-green CI, but GitHub still requires a native approval here (there are no reviews yet). Requested your review so we can proceed without bypassing branch protection. Please approve this PR, then it must be merged using Create a merge commit to preserve tagged commit e35c9de / v0.6.1-beta02 in main. Core/release and registry cutover remain gated on this merge.