No first-party way to retrieve your own already-registered public key

Background

Surfaced while debugging a muse sign verify command for the Build with Muse episode 04 script. muse sign verify requires --public-key-b64 — the raw base64url Ed25519 public key (no ed25519: prefix) — but the only time that value is ever printed is at muse auth keygen/muse auth register time. If you didn't capture it then, or need it again later (exactly this case: debugging a signing command well after the key was created), there is no command that prints it back to you.

Confirmed no existing path surfaces it:

• muse auth whoami --json — fingerprint only, no public key.
• muse auth show --json — fingerprint, algorithm, hd_path, derived paths, AVAX address... no public key.
• muse auth key list --json — fingerprint, label, timestamps. No public key.
• muse hub user read <handle> --json — public profile (repos, bio, session credits...). No public key.

The only way to recover it is to re-derive it locally from the keychain mnemonic via resolve_signing_identity() + public_key_to_b64url() — which works, but requires writing a Python snippet against internal modules; there's no first-party CLI surface for it.

Why this matters

The fingerprint (sha256:<hash of the public key>) is one-way — you can't get from a fingerprint back to the public key bytes muse sign verify actually needs. Any workflow that needs to verify an MSign header out-of-band (CI, a pre-receive hook, a third-party tool, or just a human debugging a request by hand, as happened here) needs the actual public key, and today the only source of truth for it is either your own memory of the keygen-time output, or reverse-engineering it from the mnemonic.

Scope

Add a command (or a flag on an existing one) that prints the public key for an already-registered identity:

• muse auth show --public-key (or a new dedicated field in the existing JSON output) for your own identity.
• Consider whether the hub should expose a registered public key on a public/authenticated endpoint too (e.g. as part of muse hub user read or a dedicated muse hub user public-key <handle>) — useful for anyone who needs to verify a signature from a different user's identity, not just their own.
• Decide whether agent identities (--agent-id) need the same lookup (muse auth show --agent-id X --public-key).

Acceptance criteria

• A documented command prints the exact public key muse sign verify --public-key-b64 expects, for an identity already registered on this machine, without needing to touch internal Python modules or remember keygen-time console output.