cold-start unlock: key wrap/unwrap, locked-mode daemon, IPC unlock methods

- internal/webauthn/keywrap.go: HKDF-SHA256 + AES-256-GCM WrapKey/UnwrapKey
- internal/ipc/: MethodStoreEncryptionKey/MethodUnlock wire, api structs,
  server dispatch callbacks (WrapKeyFn/UnlockFn), client stubs
- internal/config/config.go: DefaultWrappedKeyPath() method
- cmd/mavend/main.go: locked-mode boot path - detects wrapped key, starts
  locked with lockedAPI stub, wires UnlockFn that opens store + replaces
  CoreAPI on passkey assertion. env-key path stores WrapKeyFn for enrollment.
  make test green (303+, -race)

internal/ipc/wire.go

@@ -33,6 +33,8 @@ const (
 	MethodEnableTool         Method = "enable_tool"
 	MethodDisableTool        Method = "disable_tool"
 	MethodAssertStepUp       Method = "assert_stepup"
+	MethodStoreEncryptionKey Method = "store_encryption_key"
+	MethodUnlock             Method = "unlock"
 	MethodLookupTool         Method = "lookup_tool"
 	MethodListTools          Method = "list_tools"
 	MethodRevertFact         Method = "revert_fact"