fix(ci): finish the fai->chain rename in the sign workflow

The vendored sign.yml predated the product rename: it installed
and invoked the old CLI name, packed a .fai bundle, and verified
against the renamed fai/platform repo URL — every tag build died
on the missing binary. Align with the platform's current
sign-bundle template: chain CLI, .chain bundle extension,
fai/chain-private raw URL for official.pub.

Signed-off-by: flemming-it <sf@flemming.it>

.forgejo/workflows/sign.yml

@@ -2,7 +2,7 @@
 #
 # Drop-in template for any module repo under chain-modules/.
 # Triggers on tag push (vX.Y.Z) — builds the module, packs the
-# .fai bundle, signs the bundle bytes with the Flemming.AI
+# .chain bundle, signs the bundle bytes with the Flemming.AI
 # signing key (ECDSA P-256), and attaches bundle + .sig sidecar
 # to the matching Forgejo Release.
 #
@@ -42,7 +42,7 @@ jobs:
       MODULE_NAME: llm-chat
 
     steps:
-      # See fai/platform CI for background on the manual external
+      # See fai/chain-private CI for background on the manual external
       # checkout: the DinD runner cannot resolve forgejo:3000, so
       # we clone via the external URL with $GITHUB_TOKEN.
       - name: Checkout via external URL
@@ -58,7 +58,7 @@ jobs:
 
       # The chain-module-sdk dependency lives in another Forgejo org
       # behind REQUIRE_SIGNIN_VIEW. MODULE_SDK_PAT (org-level
-      # secret, read-only on fai/module-sdk) authenticates cargo's
+      # secret, read-only on fai/chain-module-sdk-rust) authenticates cargo's
       # git fetch via insteadOf.
       - name: Configure git URL rewrite for SDK fetch
         env:
@@ -93,16 +93,16 @@ jobs:
       - name: Build module (wasm32-wasip2)
         run: cargo build --release --target wasm32-wasip2
 
-      - name: Install fai CLI
+      - name: Install chain CLI
         # Pinned to the production channel; signing requires the
-        # `fai pack` command. Override FAI_VERSION when bundle
+        # `chain pack` command. Override CHAIN_VERSION when bundle
         # format compatibility matters.
         run: |
           curl -fsSL https://get.chain.flemming.ai | sh -s -- --no-bootstrap
-          # The installer drops fai at $HOME/.local/bin
+          # The installer drops chain at $HOME/.local/bin
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
           export PATH="$HOME/.local/bin:$PATH"
-          fai --version
+          chain --version
 
       - name: Stage bundle inputs
         # The wasm artefact is named after the Cargo package
@@ -125,8 +125,8 @@ jobs:
         id: pack
         run: |
           export PATH="$HOME/.local/bin:$PATH"
-          BUNDLE="${{ env.MODULE_NAME }}-${{ github.ref_name }}.fai"
-          fai pack staging --output "$BUNDLE"
+          BUNDLE="${{ env.MODULE_NAME }}-${{ github.ref_name }}.chain"
+          chain pack staging --output "$BUNDLE"
           echo "bundle=$BUNDLE" >> "$GITHUB_OUTPUT"
           ls -la "$BUNDLE"
 
@@ -141,7 +141,7 @@ jobs:
 
           This workflow signs module bundles with the Flemming.AI
           module-signing key (ECDSA P-256, PKCS#8 PEM, unencrypted).
-          The matching public key is pinned in the fai-hub binary at
+          The matching public key is pinned in the chain binary at
           infra/cosign/official.pub — hubs that require_signatures
           will reject anything not signed with this key.
 
@@ -153,7 +153,7 @@ jobs:
           ~/.fai-secrets/flemming-ai-signing.key (passphrase in
           mSecure under "Ch∆In — Module Signing Key (Private)").
 
-          See fai/platform infra/cosign/OPERATOR-HANDOFF.md for the
+          See fai/chain-private infra/cosign/OPERATOR-HANDOFF.md for the
           full setup runbook and rotation process.
           EOF
             exit 1
@@ -174,7 +174,7 @@ jobs:
         # Sanity-check: the freshly-signed bundle must verify
         # against the well-known public key before we publish it.
         run: |
-          curl -fsSL https://git.flemming.ai/fai/platform/raw/branch/main/infra/cosign/official.pub \
+          curl -fsSL https://git.flemming.ai/fai/chain-private/raw/branch/main/infra/cosign/official.pub \
             -o /tmp/official.pub
           openssl dgst -sha256 \
             -verify /tmp/official.pub \