Stabilize PKI core persistence, signing interop, and approval workflow

fix: harden FsCodec determinism and persisted type round-trips
fix: align CSR PoP verification with standards-compatible signature validation
fix: make async approval deny propagation deterministic in signing bus tests
chore: reduce IDE/Gradle drift by strengthening regression coverage

pki/.project

@@ -15,9 +15,15 @@
 			<arguments>
 			</arguments>
 		</buildCommand>
+		<buildCommand>
+			<name>net.sourceforge.pmd.eclipse.plugin.pmdBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
 	</buildSpec>
 	<natures>
 		<nature>org.eclipse.jdt.core.javanature</nature>
 		<nature>org.eclipse.buildship.core.gradleprojectnature</nature>
+		<nature>net.sourceforge.pmd.eclipse.plugin.pmdNature</nature>
 	</natures>
 </projectDescription>