release(v4.4.0): public accessor for device identity public key

Expose the local device's 32-byte Ed25519 identity public key on Shade
so apps can hand it to their own backend at enrollment time for
signature verification, key pinning or per-device safety-number
computation. Closes the gap that forced consumers to ship placeholder
random bytes their backend could store but never verify against.

- @shade/sdk Shade.identityPublicKey: Promise<Uint8Array> — getter
  mirrors the existing fingerprint accessor. Throws pre-init,
  reflects the current key after rotate(), retired key preserved in
  retired-identities storage per existing grace-period contract.
  Private key remains unreachable.
- Test in shade-sdk/tests/sdk.test.ts: round-trip match against the
  underlying storage's signingPublicKey, plus value updates after
  rotate().
- Lockstep version bump 4.3.0 → 4.4.0 across all 25 packages.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/shade-sdk/src/shade.ts

@@ -299,6 +299,26 @@ export class Shade {
     return this.address;
   }
 
+  /**
+   * The local device's Ed25519 identity public key (32 bytes).
+   *
+   * Stable for the lifetime of the identity. After {@link rotate} this
+   * reflects the new key; the previous key is preserved in retired-
+   * identities storage for the configured grace period.
+   *
+   * Hand this to your application's backend at enrollment time so it
+   * can verify signatures from this device, compute its own safety-
+   * number representation, or pin the key for later attestation. Use
+   * {@link fingerprint} instead for human side-channel comparison.
+   */
+  get identityPublicKey(): Promise<Uint8Array> {
+    if (!this.initialized) throw new Error('Not initialized');
+    return this.storage.getIdentityKeyPair().then((kp) => {
+      if (!kp) throw new Error('Identity not yet generated');
+      return kp.signingPublicKey;
+    });
+  }
+
   /**
    * `@shade/files` namespace — high-level entry point for E2EE filesystem
    * RPC. Lazily creates the underlying channel + streams bridges on first