feat(sec): 二期签名鉴权 2A 最小闭环 (agent-185) — meow_verify(Ed25519验签CLI,公钥固化,TweetNaCl+SHA256单文件) + meow_sign(宿主keygen/sign,尾部180B footer签名块,私钥仅.keys/不入库) + nyai/meow_pkg_install 验签分级(有签必验/os.meow.*无签拒装/第三方直装告警/三重绑定/原签存.mpk.src导出保留) + svc_power IPC鉴权(SO_PEERCRED→/proc/pid/exe→包名/系统身份allowlist,系统动作仅os.meow.*或系统身份) + cmd_upgrade同步签名分级防绕过

meow_verify 37e50606; nyai f2938d28; svc_power e0494eb7; launcher 24c9ee5d(含热重载)
宿主验证12项全过(正例/篡负载/篡包名/无签系统包拒/第三方直装/降级拒/导出round-trip byte-identical/verify缺失宁缺勿装/footer容忍/E2E PERM/鉴权分类)
出入: TweetNaCl替orlp/ed25519(任务允许同等实现); 读级暂仍uid==0(用户随后定案放宽到任意调用者,待改); 系统身份allowlist为启发式

patch_v2/meow_sign/build_sign.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+# build_sign.sh — meow_sign 宿主编译（产签工具；非目标机二进制，无需 mipsel）。
+#
+# 用法：
+#   ./build_sign.sh            # 宿主编译 → patch_v2/meow_sign/meow_sign
+#   ./build_sign.sh static     # 静态宿主编译（可选，便于分发/一致验证）
+set -e
+cd "$(dirname "$0")"
+ROOT="$HOME/Project/R3ProII"
+HOST_CC="${CC_HOST:-cc}"
+V="$ROOT/patch_v2/meow_verify"
+
+# tweetnacl.c 为 vendor 代码：放宽 -Wno-sign-compare / -Wno-unused-function（其 u64/u32 与 int 混比）。
+CFLAGS="-Os -Wall -Wextra"
+if [ "$1" = "static" ]; then
+    "$HOST_CC" $CFLAGS -static meow_sign.c "$V/tweetnacl.c" "$V/sha256.c" -o meow_sign_static
+    echo "== meow_sign (static) =="
+    ls -la meow_sign_static; md5sum meow_sign_static; file meow_sign_static
+    exit 0
+fi
+
+# tweetnacl.c 单独编译并放宽警告；meow_sign.c 全警告编译
+"$HOST_CC" -Os -Wno-sign-compare -Wno-unused-function -c "$V/tweetnacl.c" -o tweetnacl_meow.o
+"$HOST_CC" -Os -Wall -Wextra -c "$V/sha256.c" -o sha256_meow.o
+"$HOST_CC" $CFLAGS meow_sign.c tweetnacl_meow.o sha256_meow.o -o meow_sign
+rm -f tweetnacl_meow.o sha256_meow.o
+echo "== meow_sign (host) =="
+ls -la meow_sign; md5sum meow_sign; file meow_sign