Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture