release(v4.4.0): public accessor for device identity public key

Expose the local device's 32-byte Ed25519 identity public key on Shade
so apps can hand it to their own backend at enrollment time for
signature verification, key pinning or per-device safety-number
computation. Closes the gap that forced consumers to ship placeholder
random bytes their backend could store but never verify against.

- @shade/sdk Shade.identityPublicKey: Promise<Uint8Array> — getter
  mirrors the existing fingerprint accessor. Throws pre-init,
  reflects the current key after rotate(), retired key preserved in
  retired-identities storage per existing grace-period contract.
  Private key remains unreachable.
- Test in shade-sdk/tests/sdk.test.ts: round-trip match against the
  underlying storage's signingPublicKey, plus value updates after
  rotate().
- Lockstep version bump 4.3.0 → 4.4.0 across all 25 packages.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/shade-sdk/tests/sdk.test.ts

@@ -5,7 +5,7 @@ import {
   MemoryPrekeyStore,
   PrekeyServerEvents,
 } from '@shade/server';
-import { SubtleCryptoProvider } from '@shade/crypto-web';
+import { SubtleCryptoProvider, MemoryStorage } from '@shade/crypto-web';
 
 const crypto = new SubtleCryptoProvider();
 
@@ -182,6 +182,26 @@ describe('createShade — happy path', () => {
     const newFp = await alice.fingerprint;
     expect(newFp).not.toBe(oldFp);
   });
+
+  test('identityPublicKey exposes the device Ed25519 key and tracks rotation', async () => {
+    const storage = new MemoryStorage();
+    alice = await createShade({ prekeyServer: server.url, address: 'alice', storage });
+
+    const pk = await alice.identityPublicKey;
+    expect(pk).toBeInstanceOf(Uint8Array);
+    expect(pk.length).toBe(32);
+
+    // Matches what the underlying storage holds
+    const stored = await storage.getIdentityKeyPair();
+    expect(stored).not.toBeNull();
+    expect(pk).toEqual(stored!.signingPublicKey);
+
+    // Reflects the new key after rotate (acceptance criteria #3)
+    await alice.rotate();
+    const pkAfter = await alice.identityPublicKey;
+    expect(pkAfter.length).toBe(32);
+    expect(pkAfter).not.toEqual(pk);
+  });
 });
 
 describe('createShade — validation', () => {