Signed app-store catalogue + Pages catalogue site

[TeoSlayer]

Summary

Implements the two app-store catalogue tasks on the web4 side:

1. Signed catalogue, verified fail-closed (replaces the all-zeros trust anchor)

• New internal/catalogtrust holds the embedded ed25519 catalogue
  public key (override at build time via
  -ldflags -X …/catalogtrust.publicKeyB64=<b64> to rotate).
• pilotctl loadCatalogue now fetches a detached <url>.sig and
  verifies it against the embedded key before trusting any entry.
  Unsigned, missing-signature, or tampered catalogues are refused.
• New pilotctl appstore sign-catalogue --key <key> <catalogue.json>
  writes the detached signature and refuses to sign with a key that
  doesn't match the embedded public key (no dead signatures).
• cmd/daemon passes the embedded key into appstore.Config.CatalogPubkey,
  retiring the all-zeros placeholder at the wire-up point.
• catalogue.json is signed (catalogue.json.sig committed); README
  documents the signing + key-rotation flow.

2. Static catalogue site (GitHub Pages)

• catalogue/site/index.html — dependency-free page that fetches
  catalogue.json same-origin and renders one card per app (id, version,
  description, install command, bundle link; methods when present).
• Live preview: https://preview-appstore-catalogue-849850176181.europe-west3.run.app

Testing

• go build ./... clean (daemon + pilotctl + all packages).
• go test ./internal/catalogtrust/ ./cmd/pilotctl/ green, incl. the
  signed-catalogue load + fail-closed (missing sig / tamper) tests and the
  catalogtrust verify unit tests.

⚠️ Follow-up: Pages deploy workflow (needs workflow scope to push)

The deploy workflow below could not be pushed from this environment —
the push token lacks the workflow OAuth scope. Please add it as
.github/workflows/deploy-catalogue-site.yml:

name: Deploy app catalogue site

# Publishes the static app-store catalogue site to GitHub Pages. The page
# renders the live catalogue.json (copied alongside it, so the fetch is
# same-origin), and redeploys whenever the catalogue or the site changes.

on:
  push:
    branches: [main]
    paths:
      - "catalogue/**"
      - ".github/workflows/deploy-catalogue-site.yml"
  workflow_dispatch:

permissions:
  contents: read
  pages: write
  id-token: write

# Allow one concurrent deployment; let an in-progress run finish.
concurrency:
  group: pages
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Assemble site
        run: |
          set -euo pipefail
          mkdir -p _site
          cp catalogue/site/index.html _site/index.html
          # Copy the catalogue + detached signature so the page fetches
          # them same-origin (no CORS dependency on raw.githubusercontent).
          cp catalogue/catalogue.json _site/catalogue.json
          cp catalogue/catalogue.json.sig _site/catalogue.json.sig
          # Fail loudly if the catalogue is missing/empty.
          test -s _site/catalogue.json

      - name: Upload Pages artifact
        uses: actions/upload-pages-artifact@v3
        with:
          path: _site

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v4

It assembles _site (page + catalogue.json + .sig) and deploys to
Pages on changes under catalogue/.