fn signature_digest( manifest: &[u8], payload: &[u8], ) -> Result<[u8; 32], CliError>
Compute the domain-separated digest signed by Ed25519.