feat(security): verify signed official catalogs

[Eysn0130]

What changed

• add Ed25519 detached signatures for bundled and HTTPS official catalogs
• ship a public trust store and fail closed on missing, unknown, revoked, or mismatched signatures before catalog parsing
• keep the maintainer private key outside Git with owner-only permissions and provide offline key/signing commands
• migrate official state v1 to v2 without rebuilding or changing an existing immutable release
• retain an explicit unsigned path only for selected local development catalogs; network catalogs cannot bypass verification
• correct the benchmark provenance by rerunning at 2026-07-15T17:57:07Z, recording UTC start/end timestamps, and renaming the snapshot to its actual UTC run date

Why

The prior update channel relied on HTTPS, the repository account, monotonic sequence, and hashes, but had no public-key authenticity check. The benchmark snapshot also used the local calendar date without timezone, which appeared future-dated in UTC review.

Validation

• uv run ruff check .
• uv run pytest — 160 passed
• uv lock --check
• git diff --check
• uv build
• isolated Python 3.13 wheel install and bundled signature verification
• wheel contents verified to include catalog, signature, public trust root, and schemas, with no .pem private key
• benchmark summary matched the fresh eval report, source-tree hashes, exact signature, and UTC timestamps

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: def66b8da4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require packaged trust roots for official sync

When sync_official(..., catalog_source="https://...", trust_store_path=...) is called, verification is delegated to the caller-supplied trust store instead of the packaged trust/ keys. That conflicts with the new AGENTS.md rule that bundled and HTTPS official catalogs are trusted only against public keys packaged from trust/, and it lets an integration mark an arbitrary network catalog as signature_verified official if it passes its own key store. Please keep override trust stores out of bundled/HTTPS official sync paths, or limit this hook to tests/local development.

Useful? React with 👍 / 👎.