Add a reusable PKI session and typed synchronous operation executor
shared by direct CLI commands and versioned sequential batch plans.
Provide deterministic references, structured output, failure policies and
safe lifecycle handling without introducing a scripting language or runtime.
fix: harden FsCodec determinism and persisted type round-trips
fix: align CSR PoP verification with standards-compatible signature validation
fix: make async approval deny propagation deterministic in signing bus tests
chore: reduce IDE/Gradle drift by strengthening regression coverage
