feat: signed plugin index with validation and publish pipeline

The catalog the Punktfunk plugin store fetches. Served straight out of this
repository over Gitea's anonymous raw endpoint:

  https://git.unom.io/unom/punktfunk-plugin-index/raw/branch/main/v1/index.json
  https://git.unom.io/unom/punktfunk-plugin-index/raw/branch/main/v1/index.json.sig

Hosts verify the ed25519 signature against a compiled-in public key and only
then parse. Verified that the raw endpoint serves blobs byte-for-byte, which
the signature depends on; .gitattributes pins LF so a Windows checkout cannot
break it from the other direction.

Entries pin one exact version plus that version's registry tarball integrity
hash -- no ranges, no "latest". A plugin author publishing a new version
changes nothing for users; the new version becomes installable only when a
reviewer works the checklist and lands a new pinned entry here. That data
shape is what makes "verified on every release" enforceable rather than a
promise.

Seeded with the two first-party plugins, both integrity hashes confirmed
against the live registry:
  - @punktfunk/plugin-rom-manager 0.3.1 (linux, windows)
  - @punktfunk/plugin-playnite    0.1.1 (windows)

Tooling (bun + TypeScript, node builtins only):
  - validate: every field rule the host enforces, plus a live registry
    cross-check that the pinned version exists and its dist.integrity matches
    the pin. Strict on unknown keys, since the host silently drops entries
    that fail validation -- a `min_host` typo would otherwise ship as a
    missing version floor with no error anywhere.
  - sign / verify / keygen: ed25519 over the exact bytes of index.json.
    keygen never prints the private key; verify defaults to the host-pinned
    public key so an index can be audited with no arguments.

CI splits by trust: pull requests run validate only and hold no secrets, so a
fork PR can never reach the signing key or a token that can write to main.
Publishing from main validates, signs, self-verifies, then commits the
signature back. The loop guard is a paths-ignore filter on v1/index.json.sig,
with a [skip ci] marker as a second line of defence; ed25519 determinism means
an unchanged index re-signs to identical bytes and commits nothing at all.

CI signs after the merge, so there is a brief window where index.json is newer
than its signature. It fails closed -- hosts reject the document and keep
their last good cached catalog -- and is documented as such in the README.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tools/keys.ts

@@ -0,0 +1,59 @@
+/**
+ * Shared ed25519 key helpers.
+ *
+ * The host pins public keys in the exact string form `ed25519:<base64>`, where
+ * the base64 payload is the RAW 32-byte ed25519 public key -- NOT a DER/SPKI
+ * blob and NOT a PEM. node:crypto only exports SPKI, so we slice the raw key
+ * out of it (and splice it back in on the way in).
+ *
+ * An ed25519 SPKI DER is always exactly 44 bytes:
+ *   30 2a 30 05 06 03 2b 65 70 03 21 00 || <32-byte raw key>
+ * so the prefix is a fixed 12-byte constant.
+ */
+import { createPublicKey, type KeyObject } from "node:crypto";
+
+/** Fixed 12-byte DER prefix of an ed25519 SubjectPublicKeyInfo. */
+const SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+
+export const PUBKEY_PREFIX = "ed25519:";
+
+/**
+ * The public key currently compiled into the Punktfunk host (slot 1).
+ * `verify` defaults to this so a signed index can be checked with no arguments.
+ */
+export const DEFAULT_PUBLIC_KEY =
+  "ed25519:n/KgBQSSDZqvyGHa8PkHWHZtV1zRXLk0BdQUi4/BD/w=";
+
+/** Encode a node KeyObject public key as the host's `ed25519:<base64>` form. */
+export function encodePublicKey(key: KeyObject): string {
+  const spki = key.export({ type: "spki", format: "der" });
+  if (spki.length !== 44 || !spki.subarray(0, 12).equals(SPKI_PREFIX)) {
+    throw new Error(
+      `not an ed25519 public key (unexpected SPKI: ${spki.length} bytes)`,
+    );
+  }
+  return PUBKEY_PREFIX + spki.subarray(12).toString("base64");
+}
+
+/** Parse the host's `ed25519:<base64>` form into a usable KeyObject. */
+export function decodePublicKey(text: string): KeyObject {
+  const trimmed = text.trim();
+  if (!trimmed.startsWith(PUBKEY_PREFIX)) {
+    throw new Error(`public key must start with "${PUBKEY_PREFIX}"`);
+  }
+  const b64 = trimmed.slice(PUBKEY_PREFIX.length);
+  if (!/^[A-Za-z0-9+/]{43}=$/.test(b64)) {
+    throw new Error(
+      "public key payload must be base64 of exactly 32 raw bytes",
+    );
+  }
+  const raw = Buffer.from(b64, "base64");
+  if (raw.length !== 32) {
+    throw new Error(`public key must be 32 raw bytes, got ${raw.length}`);
+  }
+  return createPublicKey({
+    key: Buffer.concat([SPKI_PREFIX, raw]),
+    format: "der",
+    type: "spki",
+  });
+}