feat(signer): scaffold the package and enforce the no-network boundary

The signer's security claim is that it cannot reach the network, not that it
chooses not to. test/boundary.test.ts enforces that mechanically over both the
import graph and the manifest.

packages/signer/src/index.ts

@@ -0,0 +1,3 @@
+// Local signing companion for the Vector MCP server.
+// Speaks stdio only: no HTTP listener, no outbound network. See test/boundary.test.ts.
+console.error('vector-mcp-signer: not yet implemented');