cold-start unlock: key wrap/unwrap, locked-mode daemon, IPC unlock methods

- internal/webauthn/keywrap.go: HKDF-SHA256 + AES-256-GCM WrapKey/UnwrapKey
- internal/ipc/: MethodStoreEncryptionKey/MethodUnlock wire, api structs,
  server dispatch callbacks (WrapKeyFn/UnlockFn), client stubs
- internal/config/config.go: DefaultWrappedKeyPath() method
- cmd/mavend/main.go: locked-mode boot path - detects wrapped key, starts
  locked with lockedAPI stub, wires UnlockFn that opens store + replaces
  CoreAPI on passkey assertion. env-key path stores WrapKeyFn for enrollment.
  make test green (303+, -race)

internal/ipc/api.go

@@ -283,6 +283,19 @@ type TickTrace struct {
 	Rules  []RuleTrace `json:"rules"`
 }
 
+// storeEncryptionKeyReq — passkey credential public key for wrapping the store
+// encryption key at enrollment time. Called by mavweb after RegisterFinish.
+type storeEncryptionKeyReq struct {
+	PublicKey []byte `json:"public_key"`
+}
+
+// unlockReq — passkey credential public key for unwrapping the store
+// encryption key at cold-start. mavend reads the wrapped blob from its own
+// configured path; the public key is the other half needed for unwrapping.
+type unlockReq struct {
+	PublicKey []byte `json:"public_key"`
+}
+
 // ErrToolNotFound — no tool row with this name (re-exported store sentinel for
 // wire round-tripping via errors.Is).
 var ErrToolNotFound = errors.New("ipc: tool not found")