fix(ci): embed official.pub — round-trip verify fetched it from a private repo

The verify step curl-fetched the public key anonymously from the
dev repo's raw URL; since that repo went private the fetch 404s
and every signed release died at verification. Embed the PUBLIC
key verbatim (same pattern as the platform's sync-mirror.sh) so
the workflow is self-contained. Keep in lockstep with
infra/cosign/official.pub on key rotation.

Signed-off-by: flemming-it <sf@flemming.it>

.forgejo/workflows/sign.yml

@@ -174,8 +174,19 @@ jobs:
         # Sanity-check: the freshly-signed bundle must verify
         # against the well-known public key before we publish it.
         run: |
-          curl -fsSL https://git.flemming.ai/fai/chain-private/raw/branch/main/infra/cosign/official.pub \
+          # official.pub is embedded verbatim (same pattern as the
-            -o /tmp/official.pub
+          # platform's sync-mirror.sh): the dev repo is private, so
+          # an anonymous raw fetch 404s — this step could never have
+          # passed since the repo went private. It is the PUBLIC
+          # half of the signing key; embedding it is safe and makes
+          # the workflow self-contained. Keep in lockstep with
+          # fai/chain-private infra/cosign/official.pub on rotation.
+          cat > /tmp/official.pub <<'PEM'
+          -----BEGIN PUBLIC KEY-----
+          MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8SsjXx7VcvjvEbg4qrTag2GRn4kL
+          PUCZm85YCe0udF5qqKep1aeaTjmkvm9UutlDW+bUmtVSC54Qme5h3NNkFA==
+          -----END PUBLIC KEY-----
+          PEM
           openssl dgst -sha256 \
             -verify /tmp/official.pub \
             -signature <(base64 -d < "${{ steps.pack.outputs.bundle }}.sig") \