fix: parse every embedded Node release key

[MoorZhou]

Summary

• parse each independently armored Node.js release certificate instead of treating the concatenated bundle as one armor payload
• keep self-signature, fingerprint allowlist, duplicate, and complete-set checks fail-closed
• add offline coverage for the complete embedded trust store and malformed armor boundaries

Validation

• static diff review, Rustfmt, and git diff --check completed locally
• no local or WSL build, test, Pinset execution, or Provider download performed
• GitHub Actions will perform the four-platform build validation