finalizeSession

Applies the document's end-of-session credential policy to this exact credential, mirroring EUDI's own policy:

• OneTimeUse: permanently deletes the credential (key + record).

• RotateUse: no-op — the credential is reused across presentations, so it must not be deleted; consume already incremented its usage.

For OneTimeUse this destroys the signing key, so sign fails afterwards. Only call once the session is over and no further signing is needed (e.g. when leaving the screen).