feat(rpm): enable gpgcheck=1 — packages are signed + verified

The signing rollout is confirmed end to end: the latest published RPM (0.2.0-0.ci1089) carries
a header GPG signature (added by `rpm --addsign`) and passed the in-CI `rpmkeys --checksig`
self-verify before publishing (a bad/unsigned build fails that gate and never reaches the
registry). So flip every .repo snippet from gpgcheck=0 to gpgcheck=1 and add the package-signing
public key (served from the generic registry, committed at packaging/rpm/RPM-GPG-KEY-punktfunk) to
gpgkey= alongside the Gitea metadata key — dnf/rpm-ostree imports both. Covers rpm/README,
packaging/README, the bootc Containerfile, and the docs-site bazzite/fedora-kde install pages;
rpm/README's signing section reframed from "dormant/enabling" to active (+ key-rotation notes).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/bootc/Containerfile

@@ -20,7 +20,7 @@ FROM ${BASE_IMAGE}
 # packaging/rpm/README). Use it rather than COPR specifically because it carries the
 # punktfunk-web management console subpackage, which COPR's mock chroot can't build (no `bun`).
 # Group "bazzite" == the Fedora 43 base; override for a different base. Gitea signs the repo
-# metadata (repo_gpgcheck=1); the packages themselves are unsigned (gpgcheck=0).
+# metadata (repo_gpgcheck=1) and the packages are GPG-signed (gpgcheck=1, the packages@unom.io key).
 ARG PUNKTFUNK_RPM_GROUP=bazzite
 
 # RPM Fusion nonfree provides the NVENC-capable ffmpeg-libs punktfunk records/encodes with.
@@ -35,8 +35,8 @@ RUN printf '%s\n' \
       '[gitea-unom-punktfunk]' \
       'name=punktfunk (unom)' \
       "baseurl=https://git.unom.io/api/packages/unom/rpm/${PUNKTFUNK_RPM_GROUP}" \
-      'enabled=1' 'gpgcheck=0' 'repo_gpgcheck=1' \
-      'gpgkey=https://git.unom.io/api/packages/unom/rpm/repository.key' \
+      'enabled=1' 'gpgcheck=1' 'repo_gpgcheck=1' \
+      'gpgkey=https://git.unom.io/api/packages/unom/rpm/repository.key https://git.unom.io/api/packages/unom/generic/punktfunk-keys/1/RPM-GPG-KEY-punktfunk' \
       > /etc/yum.repos.d/punktfunk.repo \
  && dnf5 -y install punktfunk punktfunk-web \
  && dnf5 clean all