Fix ECDSA signature verification: use lowercase 'sha256' for ES256 algorithm

Co-authored-by: xuyushun441-sys <255036401+xuyushun441-sys@users.noreply.github.com>

Author: Copilot

packages/core/src/security/plugin-signature-verifier.ts

@@ -308,8 +308,8 @@ export class PluginSignatureVerifier {
     try {
       // Create verify object based on algorithm
       if (this.config.algorithm === 'ES256') {
-        // ECDSA verification
-        const verify = cryptoModule.createVerify('SHA256');
+        // ECDSA verification - requires lowercase 'sha256'
+        const verify = cryptoModule.createVerify('sha256');
         verify.update(data);
         return verify.verify(
           {