fix: pin pkcs8 to 0.11.0-rc.11 to unblock bundle CI

[zachsmith1]

Summary

• pkcs8 0.11.0-rc.12 (released 2026-04-27) made Error::KeyMalformed a tuple variant carrying KeyError. Both ed25519 3.0.0-rc.4 and ed25519-dalek 3.0.0-pre.1 — pulled in transitively via iroh* — still use it as a unit variant, so the build fails with ? couldn't convert the error to pkcs8::Error in ed25519/src/pkcs8.rs and ed25519-dalek/src/signing.rs.
• The bundle workflow runs cargo generate-lockfile on all three platforms before dx bundle --locked, which discards the committed lock and re-resolves to the latest matching prerelease. The pin must live in the manifest, not just Cargo.lock.
• pkcs8 = "=0.11.0-rc.11" in lib/Cargo.toml intersects with ed25519's ^0.11.0-rc.10 requirement and locks the last known-working version.

Why not [patch.crates-io] to a fixed ed25519?

Upstream pushed a fix in RustCrypto/signatures d8b1875a that targets pkcs8 rc.12, but the matching ed25519-dalek change isn't in dalek's tree yet — patching only ed25519 leaves dalek's signing.rs broken. A version pin is the smallest stable workaround until both crates publish releases compatible with rc.12.

Follow-up

The deeper issue is cargo generate-lockfile in bundle.yml — it undermines lockfile reproducibility and lets prerelease churn upstream break the build at any time. Worth replacing with a surgical workspace-only lock sync in a follow-up PR.

Test plan

• cargo check --workspace --locked passes locally
• Cargo.lock resolves pkcs8 to 0.11.0-rc.11
• Bundle workflow succeeds on all three platforms (macOS / Linux / Windows)