fix: validate Node signing authority precisely

[MoorZhou]

Summary

• keep pinned primary fingerprints as the Node.js trust roots
• validate every signing subkey binding and required back-signature
• avoid treating unrelated historical third-party User ID certifications as self-signatures
• preserve the explicit revoked-fingerprint denylist and complete allowlist checks

Validation

• static diff review, Rustfmt, and git diff --check completed locally
• no local or WSL build, test, Pinset execution, or Provider download performed
• GitHub Actions will perform the four-platform build validation