ci: the release carries the keyed flatpakref

The Bundle step copied the checkout's flatpakref into the release before
the publish step wrote the keyed one to the web root, so 1.0.0's asset
said GPGKey=GPG_KEY_BASE64_PLACEHOLDER and installing from it failed. A
step after publishing copies the web root's copy into the release files
and writes their checksums. Released as 1.0.1.

packaging/flatpak/net.catcrafts.CrafterReview.metainfo.xml

@@ -27,6 +27,14 @@
   </provides>
   <content_rating type="oars-1.1"/>
   <releases>
+    <release version="1.0.1" date="2026-11-02">
+      <description>
+        <p>Fixes</p>
+        <ul>
+          <li>The <code>.flatpakref</code> attached to a release carries the Catcrafts repository's key, so installing from that file works; 1.0.0's had a placeholder.</li>
+        </ul>
+      </description>
+    </release>
     <release version="1.0.0" date="2026-11-02">
       <description>
         <p>New</p>