fix(ci): attach the flatpakref with the repo's key to releases

The Bundle step copied packaging/flatpak/net.catcrafts.CrafterBuild.flatpakref
into dist/ as the checkout has it, with GPGKey=GPG_KEY_BASE64_PLACEHOLDER,
so all six releases, 2.0.0 to 5.0.0, attach a .flatpakref that does not
install: `flatpak install --from` it stops with "GPG: Unable to export
keys: GPGME: No data" (Flatpak 1.18.4) before it adds the remote. The
copy the publish step writes to the web root has the key filled in, and
installing from it goes ahead.

The key is known only from the publish step on, so the release's copy,
and SHA256SUMS over it, are made there from the web root's file instead
of in the Bundle step.

.forgejo/workflows/ci.yaml

@@ -120,8 +120,6 @@ jobs:
         run: |
           mkdir -p dist
           flatpak build-bundle repo "dist/crafter-build-${{ steps.meta.outputs.version }}.flatpak" "$APP_ID" "${{ steps.meta.outputs.branch }}"
-          cp packaging/flatpak/net.catcrafts.CrafterBuild.flatpakref dist/
-          (cd dist && sha256sum * > SHA256SUMS)
           ls -la dist
 
       - name: Upload bundle
@@ -160,6 +158,12 @@ jobs:
           key=$(gpg --export "$FLATPAK_GPG_KEY_ID" | base64 --wrap=0)
           sed "s|GPGKey=.*|GPGKey=$key|" packaging/flatpak/catcrafts.flatpakrepo > "$WEB_DIR/catcrafts.flatpakrepo"
           sed "s|GPGKey=.*|GPGKey=$key|" packaging/flatpak/net.catcrafts.CrafterBuild.flatpakref > "$WEB_DIR/net.catcrafts.CrafterBuild.flatpakref"
+          # The release attaches this .flatpakref, not the one in the
+          # checkout: that one has a placeholder where the key goes, and
+          # flatpak cannot install from it.
+          cp "$WEB_DIR/net.catcrafts.CrafterBuild.flatpakref" dist/
+          (cd dist && sha256sum * > SHA256SUMS)
+          ls -la dist
 
       - name: Rolling 'latest' release
         if: github.event_name != 'pull_request' && github.ref_type != 'tag'