feat: signed plugin index with validation and publish pipeline

The catalog the Punktfunk plugin store fetches. Served straight out of this
repository over Gitea's anonymous raw endpoint:

  https://git.unom.io/unom/punktfunk-plugin-index/raw/branch/main/v1/index.json
  https://git.unom.io/unom/punktfunk-plugin-index/raw/branch/main/v1/index.json.sig

Hosts verify the ed25519 signature against a compiled-in public key and only
then parse. Verified that the raw endpoint serves blobs byte-for-byte, which
the signature depends on; .gitattributes pins LF so a Windows checkout cannot
break it from the other direction.

Entries pin one exact version plus that version's registry tarball integrity
hash -- no ranges, no "latest". A plugin author publishing a new version
changes nothing for users; the new version becomes installable only when a
reviewer works the checklist and lands a new pinned entry here. That data
shape is what makes "verified on every release" enforceable rather than a
promise.

Seeded with the two first-party plugins, both integrity hashes confirmed
against the live registry:
  - @punktfunk/plugin-rom-manager 0.3.1 (linux, windows)
  - @punktfunk/plugin-playnite    0.1.1 (windows)

Tooling (bun + TypeScript, node builtins only):
  - validate: every field rule the host enforces, plus a live registry
    cross-check that the pinned version exists and its dist.integrity matches
    the pin. Strict on unknown keys, since the host silently drops entries
    that fail validation -- a `min_host` typo would otherwise ship as a
    missing version floor with no error anywhere.
  - sign / verify / keygen: ed25519 over the exact bytes of index.json.
    keygen never prints the private key; verify defaults to the host-pinned
    public key so an index can be audited with no arguments.

CI splits by trust: pull requests run validate only and hold no secrets, so a
fork PR can never reach the signing key or a token that can write to main.
Publishing from main validates, signs, self-verifies, then commits the
signature back. The loop guard is a paths-ignore filter on v1/index.json.sig,
with a [skip ci] marker as a second line of defence; ed25519 determinism means
an unchanged index re-signs to identical bytes and commits nothing at all.

CI signs after the merge, so there is a brief window where index.json is newer
than its signature. It fails closed -- hosts reject the document and keep
their last good cached catalog -- and is documented as such in the README.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tools/verify.ts

@@ -0,0 +1,106 @@
+#!/usr/bin/env bun
+/**
+ * Verify v1/index.json.sig against v1/index.json.
+ *
+ * This is exactly what the host does before it will parse a single byte of the
+ * catalog, so a green run here means a host that pins the same key will accept
+ * the index. Used as a post-sign self-check in CI, and by anyone auditing.
+ *
+ * Public key, in precedence order:
+ *   --pub ed25519:<base64>   (or a path to a file containing that string)
+ *   $INDEX_PUBLIC_KEY
+ *   the key currently pinned in the host (see tools/keys.ts)
+ *
+ * Usage:
+ *   bun tools/verify.ts [--pub ed25519:...] [path/to/index.json]
+ */
+import { verify } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { DEFAULT_PUBLIC_KEY, PUBKEY_PREFIX, decodePublicKey } from "./keys.ts";
+
+function die(message: string): never {
+  console.error(`error: ${message}`);
+  process.exit(1);
+}
+
+const args = process.argv.slice(2);
+let pubArg: string | undefined;
+const positional: string[] = [];
+for (let i = 0; i < args.length; i++) {
+  const arg = args[i]!;
+  if (arg === "--pub") {
+    pubArg = args[++i];
+    if (!pubArg) die("--pub needs a value");
+  } else if (arg.startsWith("--pub=")) {
+    pubArg = arg.slice("--pub=".length);
+  } else if (arg.startsWith("--")) {
+    die(`unknown flag ${arg}`);
+  } else {
+    positional.push(arg);
+  }
+}
+
+let source = "host-pinned default";
+let pubText = DEFAULT_PUBLIC_KEY;
+if (pubArg) {
+  // Accept either the literal ed25519:... string or a file containing it.
+  if (!pubArg.startsWith(PUBKEY_PREFIX) && existsSync(pubArg)) {
+    source = pubArg;
+    pubText = readFileSync(pubArg, "utf8").trim();
+  } else {
+    source = "--pub";
+    pubText = pubArg;
+  }
+} else if (process.env.INDEX_PUBLIC_KEY) {
+  source = "$INDEX_PUBLIC_KEY";
+  pubText = process.env.INDEX_PUBLIC_KEY;
+}
+
+let publicKey;
+try {
+  publicKey = decodePublicKey(pubText);
+} catch (err) {
+  die(`bad public key from ${source}: ${(err as Error).message}`);
+}
+
+const file = resolve(positional[0] ?? "v1/index.json");
+const sigFile = `${file}.sig`;
+
+let data: Buffer;
+try {
+  data = readFileSync(file);
+} catch (err) {
+  die(`cannot read ${file}: ${(err as Error).message}`);
+}
+
+let sigText: string;
+try {
+  sigText = readFileSync(sigFile, "utf8");
+} catch (err) {
+  die(`cannot read ${sigFile}: ${(err as Error).message}`);
+}
+
+// Whitespace-tolerant on read, matching the host.
+const b64 = sigText.replace(/\s+/g, "");
+if (!/^[A-Za-z0-9+/]+={0,2}$/.test(b64)) {
+  die(`${sigFile} is not valid base64`);
+}
+const signature = Buffer.from(b64, "base64");
+if (signature.length !== 64) {
+  die(`${sigFile} must decode to a 64-byte ed25519 signature, got ${signature.length} bytes`);
+}
+
+if (!verify(null, data, publicKey, signature)) {
+  console.error(`FAILED: signature in ${sigFile} does not match ${file}`);
+  console.error(`  key used: ${pubText.trim()} (from ${source})`);
+  console.error(
+    "\n  Either the index was modified after signing, or it was signed with a\n" +
+      "  different key than the one being checked. Re-run `bun run sign`, and\n" +
+      "  confirm the signing key matches a slot the host pins.",
+  );
+  process.exit(1);
+}
+
+console.log(`OK: ${sigFile} is a valid signature over ${file} (${data.length} bytes)`);
+console.log(`    key: ${pubText.trim()} (from ${source})`);