fix(ci): sign with a key kept on the runner host

The runner is our own machine, so the repo signing key does not need to
pass through the forge as a secret. It is generated once under
/etc/crafter-flatpak on the host and bind-mounted read-only into the job
container, where each run imports it into a throwaway keyring. One less
secret to manage, and the private key never leaves the box that uses it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.forgejo/workflows/ci.yaml

@@ -7,9 +7,10 @@ name: Flatpak
 #   tag X.Y.Z     -> publish as `stable` and create release X.Y.Z
 #
 # The `flatpak` runner label is the privileged runner on the Hetzner box
-# (bubblewrap needs it) with three volumes allowed: the Sdk install, the
+# (bubblewrap needs it) with four volumes allowed: the Sdk install, the
 # flatpak-builder state (ccache and the LLVM module, so only crafter-build
-# itself rebuilds on a normal run) and the published repo's web root.
+# itself rebuilds on a normal run), the published repo's web root, and the
+# repo signing key, which lives on the runner host and never in the forge.
 on:
   pull_request:
     branches: [master]
@@ -35,6 +36,7 @@ jobs:
         -v crafter-flatpak-system:/var/lib/flatpak
         -v crafter-flatpak-builder:/root/.cache/flatpak-builder
         -v /var/www/flatpak:/srv/flatpak
+        -v /etc/crafter-flatpak:/run/crafter-flatpak:ro
     steps:
       - name: Install tools
         run: |
@@ -118,13 +120,18 @@ jobs:
 
       - name: Publish to the Catcrafts repo
         if: github.event_name != 'pull_request'
-        env:
-          FLATPAK_GPG_PRIVATE_KEY: ${{ secrets.FLATPAK_GPG_PRIVATE_KEY }}
-          FLATPAK_GPG_KEY_ID: ${{ secrets.FLATPAK_GPG_KEY_ID }}
         run: |
           set -eu
+          # The signing key is generated once on the runner host
+          # (/etc/crafter-flatpak: signing-key.asc and key-id) and mounted
+          # read-only; it is imported into a throwaway keyring per run.
+          if [ ! -s /run/crafter-flatpak/signing-key.asc ] || [ ! -s /run/crafter-flatpak/key-id ]; then
+            echo "no signing key under /etc/crafter-flatpak on the runner host; generate it as described in AGENTS.md (CI and publishing)" >&2
+            exit 1
+          fi
           export GNUPGHOME=$(mktemp -d)
-          printf '%s' "$FLATPAK_GPG_PRIVATE_KEY" | gpg --batch --quiet --import
+          gpg --batch --quiet --import /run/crafter-flatpak/signing-key.asc
+          FLATPAK_GPG_KEY_ID=$(cat /run/crafter-flatpak/key-id)
           # The live repo is the canonical copy; builds are promoted into it,
           # never built into it.
           [ -d "$REPO_DIR" ] || ostree init --repo="$REPO_DIR" --mode=archive