fix(flatpak): GPG-sign repo summaries during build and deploy

Unsigned summary updates left stale summary.sig files on the server,
causing BAD signature errors for clients. Sign exports and summaries
with the BearWave repo key and require .sig files before deploy.

scripts/build-flatpak.sh

@@ -4,8 +4,15 @@ set -euo pipefail
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$root"
 
-flatpak-builder --repo=flatpak_repo --force-clean flatpak_build de.nerdbear.bearwave.json
+gpg_key_id="${BEARWAVE_FLATPAK_GPG_KEY:-AA1D2F0170800855}"
-flatpak build-update-repo flatpak_repo
+
+flatpak-builder \
+  --repo=flatpak_repo \
+  --gpg-sign="${gpg_key_id}" \
+  --force-clean \
+  flatpak_build \
+  de.nerdbear.bearwave.json
+flatpak build-update-repo --gpg-sign="${gpg_key_id}" flatpak_repo
 
 echo "Flatpak repo updated in flatpak_repo/."
 echo "Deploy with: scripts/deploy-flatpak.sh"

scripts/deploy-flatpak.sh

@@ -11,6 +11,11 @@ if [[ ! -d flatpak_repo/objects ]]; then
   exit 1
 fi
 
+if [[ ! -f flatpak_repo/summary.sig || ! -f flatpak_repo/summary.idx.sig ]]; then
+  echo "Missing summary.sig files. Run scripts/build-flatpak.sh with GPG signing first." >&2
+  exit 1
+fi
+
 rsync -avz \
   -e 'ssh -o RemoteCommand=none -o RequestTTY=no' \
   --no-group --no-owner \