feat: signed plugin index with validation and publish pipeline

The catalog the Punktfunk plugin store fetches. Served straight out of this
repository over Gitea's anonymous raw endpoint:

  https://git.unom.io/unom/punktfunk-plugin-index/raw/branch/main/v1/index.json
  https://git.unom.io/unom/punktfunk-plugin-index/raw/branch/main/v1/index.json.sig

Hosts verify the ed25519 signature against a compiled-in public key and only
then parse. Verified that the raw endpoint serves blobs byte-for-byte, which
the signature depends on; .gitattributes pins LF so a Windows checkout cannot
break it from the other direction.

Entries pin one exact version plus that version's registry tarball integrity
hash -- no ranges, no "latest". A plugin author publishing a new version
changes nothing for users; the new version becomes installable only when a
reviewer works the checklist and lands a new pinned entry here. That data
shape is what makes "verified on every release" enforceable rather than a
promise.

Seeded with the two first-party plugins, both integrity hashes confirmed
against the live registry:
  - @punktfunk/plugin-rom-manager 0.3.1 (linux, windows)
  - @punktfunk/plugin-playnite    0.1.1 (windows)

Tooling (bun + TypeScript, node builtins only):
  - validate: every field rule the host enforces, plus a live registry
    cross-check that the pinned version exists and its dist.integrity matches
    the pin. Strict on unknown keys, since the host silently drops entries
    that fail validation -- a `min_host` typo would otherwise ship as a
    missing version floor with no error anywhere.
  - sign / verify / keygen: ed25519 over the exact bytes of index.json.
    keygen never prints the private key; verify defaults to the host-pinned
    public key so an index can be audited with no arguments.

CI splits by trust: pull requests run validate only and hold no secrets, so a
fork PR can never reach the signing key or a token that can write to main.
Publishing from main validates, signs, self-verifies, then commits the
signature back. The loop guard is a paths-ignore filter on v1/index.json.sig,
with a [skip ci] marker as a second line of defence; ed25519 determinism means
an unchanged index re-signs to identical bytes and commits nothing at all.

CI signs after the merge, so there is a brief window where index.json is newer
than its signature. It fails closed -- hosts reject the document and keep
their last good cached catalog -- and is documented as such in the README.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tools/sign.ts

@@ -0,0 +1,105 @@
+#!/usr/bin/env bun
+/**
+ * Sign v1/index.json with an ed25519 private key.
+ *
+ * The signature is over the EXACT BYTES of index.json -- no canonicalisation,
+ * no re-serialisation. Whatever is committed is what gets signed and what the
+ * host hashes, so any whitespace change invalidates the signature (validate.ts
+ * enforces canonical formatting to keep that from happening by accident).
+ *
+ * Output is base64 of the raw 64-byte signature, written to v1/index.json.sig.
+ *
+ * Key input, in precedence order:
+ *   --key <path>            PKCS#8 PEM file
+ *   $INDEX_SIGNING_KEY_FILE PKCS#8 PEM file
+ *   $INDEX_SIGNING_KEY      PKCS#8 PEM contents (this is what CI uses)
+ *
+ * Usage:
+ *   bun tools/sign.ts [--key path/to/key.pem] [path/to/index.json]
+ */
+import { createPrivateKey, createPublicKey, sign } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { encodePublicKey } from "./keys.ts";
+
+function die(message: string): never {
+  console.error(`error: ${message}`);
+  process.exit(1);
+}
+
+const args = process.argv.slice(2);
+let keyPath: string | undefined;
+const positional: string[] = [];
+for (let i = 0; i < args.length; i++) {
+  const arg = args[i]!;
+  if (arg === "--key") {
+    keyPath = args[++i];
+    if (!keyPath) die("--key needs a path");
+  } else if (arg.startsWith("--key=")) {
+    keyPath = arg.slice("--key=".length);
+  } else if (arg.startsWith("--")) {
+    die(`unknown flag ${arg}`);
+  } else {
+    positional.push(arg);
+  }
+}
+
+keyPath ??= process.env.INDEX_SIGNING_KEY_FILE;
+
+let pem: string;
+let source: string;
+if (keyPath) {
+  source = keyPath;
+  try {
+    pem = readFileSync(keyPath, "utf8");
+  } catch (err) {
+    die(`cannot read key file ${keyPath}: ${(err as Error).message}`);
+  }
+} else if (process.env.INDEX_SIGNING_KEY) {
+  source = "$INDEX_SIGNING_KEY";
+  pem = process.env.INDEX_SIGNING_KEY;
+} else {
+  die(
+    "no signing key. Pass --key <pkcs8.pem>, or set INDEX_SIGNING_KEY_FILE (path) " +
+      "or INDEX_SIGNING_KEY (PEM contents).",
+  );
+}
+
+// Tolerate secrets stores that mangle newlines into literal \n.
+if (!pem.includes("\n") && pem.includes("\\n")) pem = pem.replace(/\\n/g, "\n");
+
+let key;
+try {
+  key = createPrivateKey({ key: pem, format: "pem" });
+} catch (err) {
+  die(`${source} is not a readable PKCS#8 PEM private key: ${(err as Error).message}`);
+}
+if (key.asymmetricKeyType !== "ed25519") {
+  die(`${source} is a ${key.asymmetricKeyType ?? "unknown"} key; an ed25519 key is required`);
+}
+
+const file = resolve(positional[0] ?? "v1/index.json");
+const sigFile = `${file}.sig`;
+
+let data: Buffer;
+try {
+  data = readFileSync(file);
+} catch (err) {
+  die(`cannot read ${file}: ${(err as Error).message}`);
+}
+
+// ed25519 is a pure signature scheme: the digest argument MUST be null.
+const signature = sign(null, data, key);
+if (signature.length !== 64) {
+  die(`expected a 64-byte ed25519 signature, got ${signature.length}`);
+}
+
+writeFileSync(sigFile, `${signature.toString("base64")}\n`);
+
+// Report the public key so the operator can eyeball WHICH key just signed --
+// the most likely deploy mistake is signing with a key the host does not pin.
+const publicKey = encodePublicKey(createPublicKey(key));
+console.log(`signed  ${file} (${data.length} bytes)`);
+console.log(`wrote   ${sigFile}`);
+console.log(`key     ${publicKey}`);
+console.log("\nThe host must pin that public key in one of its two key slots.");