feat: verify and stage signed runtime images

Review threads live on the whole diff, not on one commit, so none are shown here - a thread's line means something in the branch's final form, and painting it into an intermediate step would put it on code it is not about.

bun.lockmodified+1-0

Changes to bun.lock

		⋯21 linesShow the 21 lines above this hunk@@ -22,6 +22,7 @@
22	22	"@stacksjs/stx": "0.2.564",
23	23	"@stacksjs/testing": "^0.75.221",
24	24	"@stacksjs/validation": "^0.75.221",
	25	+ "@tufjs/canonical-json": "2.0.0",
25	26	"stacks": "^0.75.221",
26	27	"ts-images": "0.2.31",
27	28	"tuf-js": "6.0.0",

package.jsonmodified+2-1

Changes to package.json

		⋯49 linesShow the 49 lines above this hunk@@ -50,7 +50,8 @@
50	50	"@stacksjs/validation": "^0.75.221",
51	51	"stacks": "^0.75.221",
52	52	"ts-images": "0.2.31",
53		- "tuf-js": "6.0.0"
	53	+ "tuf-js": "6.0.0",
	54	+ "@tufjs/canonical-json": "2.0.0"
54	55	},
55	56	"workspaces": [
56	57	"storage/framework",