Address review on the export manifest

- canonicalize rejects non-plain objects. A Date serialised as {}, a
  Buffer enumerated its indices, a Map became {}. None can reach a
  manifest body today, but a silently wrong serialisation is the same
  failure class as the non-finite number already rejected, and every
  digest rests on this function.
- Validate MANIFEST_SIGNING_KEY at boot. A malformed key previously
  surfaced when a user's first export failed; it now stops startup with
  the same message, and a working key logs its key id.
- Bulk copy takes size_bytes from the bytes being hashed rather than
  inheriting it from the active version, so size and content_sha256
  always describe the same content. A verifier that stats a file before
  hashing it should not see a size that disagrees with the hash.
- README notes that soft-deleted versions stay in the manifest. Dropping
  them would weaken the attestation, but it makes their filenames and
  timestamps visible to anyone with project access, which is worth
  stating rather than leaving to be discovered.