Signed locally with the key whose public half the host pins. ed25519 is
deterministic, so the publish workflow re-signing this exact document with
the same key produces byte-identical output — this is the bootstrap for a
repo whose CI secret is not yet configured, not a parallel signing path.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
