Stop verifying composition signatures: the node applies only its own

ADR 0593 §6: a composition read from composed-<node> is a record never
applied, and the engine applies only what it composes itself, so no
composition carries a signature and nothing is verified. The agent's
trusted signers, its signed-composition test and the unused signing
helper of the integration bed go, so mesh-sdk can drop SignComposed,
VerifyComposed and Composed.Signature.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

internal/selfcompose/composedstate_test.go

@@ -123,7 +123,7 @@ func TestTheNodePublishesItsCompositions(t *testing.T) {
 	}
 	if raw := state.kv[lemursKey].Value; raw != nil {
 		comp, err := delivery.DecodeComposed(raw)
-		if err != nil || comp.Module != "lemurs" || comp.FP != fp || comp.Signature != nil || len(comp.Resources) == 0 {
+		if err != nil || comp.Module != "lemurs" || comp.FP != fp || len(comp.Resources) == 0 {
 			t.Errorf("the published composition of lemurs: %+v, %v", comp, err)
 		}
 	}