Factory and build-time keys (local-only flow)

This toolkit uses local keys only.

Current usage:

- `factory_signing/factory_signing_key.pem`
  Used to sign packaged artifacts (`.bin`, config files).
- `factory_signing/factory_signing_pubkey.pem`
  Public key used by the flashing tool for signature verification.
- `firmware/fw_key.bin`
  32-byte firmware envelope key used for `.bin.enc` encrypt/decrypt.
  It is copied into release package as `keys/firmware/fw_key.bin`.

Only the key files listed above are required in this repository.