c2pa-python v0.37+ rejects self-signed certificates and requires a
CA-to-leaf chain. Generate a root CA plus a leaf signing cert that carries
the FieldWitness identity key, signed by the root CA, and store all three
files under the identity directory.
Migrate to the new c2pa-python API: Signer.from_callback with the
C2paSigningAlg.ED25519 enum, positional Builder.sign() args, and
get_or_create_c2pa_cert(config, private_key, privacy_level). Bump the
dependency to c2pa-python>=0.37.0.
Fix CLI record lookup (get_record takes an int index, not a string ID),
hashing lookup (get_records_by_image_sha256), and use the c2pa.created
action for original-content attestations.
8c85ba748e