fix: Phase 3 — command injection, unwrap/expect panics, unsigned image acceptance

- VPN key gen: replaced sh -c with format string (command injection) with
  safe stdin piping to wg pubkey
- Secrets manager: replaced .unwrap() on path.parent() with proper error
- Tor proxy: replaced .expect("valid proxy") with continue on error
- Image verifier: added require_signatures flag, strict mode rejects
  unsigned images and missing cosign binary

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/tor.rs

@@ -522,7 +522,11 @@ async fn notify_federation_peers_address_change(
                         });
                         let url = format!("http://{}/rpc/v1", &peer.onion);
                         let client = match reqwest::Client::builder()
-                            .proxy(reqwest::Proxy::all(format!("socks5h://{}", proxy)).unwrap_or_else(|_| reqwest::Proxy::all("socks5h://127.0.0.1:9050").expect("valid proxy")))
+                            .proxy(match reqwest::Proxy::all(format!("socks5h://{}", proxy))
+                                .or_else(|_| reqwest::Proxy::all("socks5h://127.0.0.1:9050")) {
+                                Ok(p) => p,
+                                Err(_) => continue,
+                            })
                             .timeout(std::time::Duration::from_secs(30))
                             .build()
                         {