Stabilize PKI core persistence, signing interop, and approval workflow

fix: harden FsCodec determinism and persisted type round-trips
fix: align CSR PoP verification with standards-compatible signature validation
fix: make async approval deny propagation deterministic in signing bus tests
chore: reduce IDE/Gradle drift by strengthening regression coverage

lib/build.gradle

@@ -6,7 +6,7 @@ plugins {
 group='org.egothor'
 
 dependencies {
-	implementation 'org.bouncycastle:bcpkix-jdk18on'
+	api 'org.bouncycastle:bcpkix-jdk18on'
 	implementation 'org.egothor:conflux'
 	implementation 'org.apache.commons:commons-imaging'
 }