ci: the release carries the keyed flatpakref

The Bundle step copied the checkout's flatpakref into the release before
the publish step wrote the keyed one to the web root, so 1.0.0's asset
said GPGKey=GPG_KEY_BASE64_PLACEHOLDER and installing from it failed. A
step after publishing copies the web root's copy into the release files
and writes their checksums. Released as 1.0.1.

.forgejo/workflows/ci.yaml

@@ -259,9 +259,6 @@ jobs:
         run: |
           mkdir -p dist
           flatpak build-bundle repo "dist/crafter-review-${{ steps.meta.outputs.version }}.flatpak" "$APP_ID" stable
-          cp packaging/flatpak/net.catcrafts.CrafterReview.flatpakref dist/
-          (cd dist && sha256sum * > SHA256SUMS)
-          ls -la dist
 
       - name: Upload bundle
         uses: actions/upload-artifact@v3
@@ -296,6 +293,15 @@ jobs:
           sed "s|GPGKey=.*|GPGKey=$key|" packaging/flatpak/net.catcrafts.CrafterReview.flatpakref > "$WEB_DIR/net.catcrafts.CrafterReview.flatpakref"
           flock -u 9
 
+      - name: Release files
+        # The flatpakref as published, with the repo's key - the checkout's
+        # carries a placeholder - and the checksums of what the release carries.
+        run: |
+          set -eu
+          cp "$WEB_DIR/net.catcrafts.CrafterReview.flatpakref" dist/
+          (cd dist && sha256sum * > SHA256SUMS)
+          ls -la dist
+
       - name: Tag the release
         run: |
           # The release's tag at the pushed commit. Never forced: a tag that

packaging/flatpak/net.catcrafts.CrafterReview.metainfo.xml

@@ -27,6 +27,14 @@
   </provides>
   <content_rating type="oars-1.1"/>
   <releases>
+    <release version="1.0.1" date="2026-11-02">
+      <description>
+        <p>Fixes</p>
+        <ul>
+          <li>The <code>.flatpakref</code> attached to a release carries the Catcrafts repository's key, so installing from that file works; 1.0.0's had a placeholder.</li>
+        </ul>
+      </description>
+    </release>
     <release version="1.0.0" date="2026-11-02">
       <description>
         <p>New</p>