Summary

• Block.id — blake2b-256 of header + cert_hash + merkle_root + tx_count (LE)
• Transaction.id() — blake2b-256 of sign bytes
• Certificate.hash() — blake2b-256 of encoded certificate
• Simple merkle tree for TX root
• Header.encode() — serializes header to bytes, used by Block
• All encode methods now accept and return for clean chaining
• BondPayload uses type with proper varint-prefixed encode/decode
• Test verifies block id matches expected value