fix(native-certgen): address Phase 0-1 validation findings

EC keygen now returns proper SPKI DER instead of raw point bytes.
RSA keygen uses caller-supplied exponent via new_with_exp() and
validates key size to 2048/3072/4096. Keybox parser extracts leaf
subject DN (not issuer). Added AttestKey=7 to KeyPurpose. Realigned
error variants with spec.

native-certgen/src/lib.rs

@@ -1,7 +1,4 @@
 mod error;
 mod types;
 mod keygen;
-// mod attestation;  // Phase 2
 pub mod keybox;
-// mod certbuilder;  // Phase 3
-// mod logging;      // Phase 3