fix(packages): match APK index key name

[jmgilman]

Summary

• derive the APK index signing identity from the reviewed aggregate public-key name
• mount the existing private key under that identity inside the isolated Alpine container
• reject unsafe key identities and cover a differently named host key

Verification

• go test ./internal/adapter/repogen ./internal/stage/pkgrepo ./internal/cli
• focused golangci-lint returned 0 issues
• production replay reached APK installation and reported the previous index signature as untrusted