Adds .hanzo/workflows/cicd.yml calling the canonical pipeline and drops the
GitHub-hosted workflows it replaces. Lands here because this is where the repo
is written — git.hanzo.ai is upstream and github.com is its push mirror, so the
same change made on github.com never reaches the runner fleet.
The four callers reached github.com/luxfi/vm/platformvm/signer for a BLS key
plus a signature over it. That module no longer publishes the path, and keys
sits below the node: it manages keys, so it should not need a VM to make one.
crypto/bls, already a dependency, has everything the type needs.
Co-authored-by: Hanzo Dev <[email protected]>
service_identity.go + hybrid.go are pure-function, I/O-free derivation (BIP-39
-> BIP-32 -> ML-DSA-65 NodeID) that imports only luxfi/crypto + go-bip32/39 +
ids — NO kms import, so no keys<->kms cycle. Previously these lived only
vendored-in-kms; consumers (hanzoai/kms/sdk, bank, kms-operator) referenced
keys.ServiceIdentity/NewServiceIdentity that the released keys lacked. This is
the canonical home. (LoadMnemonic stays out of keys — it needs kms/zapclient.)
Co-authored-by: Hanzo Dev <[email protected]>
zeekay
