fix(catalog-console): close the vacuous review gate; split catalog/release signing keys

Fixes #68 findings 1 and 5.

Finding 1 -- the review gate signed without reviewing anything:
- ReviewWindow._on_sign hardcoded "main" as the TOCTOU comparison ref, so
  any PR review (where _on_load pins the PR head's blob SHA) could never
  sign; the only working path was main-vs-itself, whose empty diff made
  can_sign() vacuously True (set() <= set()). Commit b08cf21 signed 19
  entries through exactly that path with zero of them reviewed.
- can_sign() now refuses an empty changeset outright, and itself checks
  has_blocking_risk() across every changed entry rather than trusting the
  GUI to have disabled a checkbox.
- ReviewSession now carries loaded_ref (the exact ref reviewed); a new pure
  sign_precondition(session, resolve_blob_sha) resolves the TOCTOU SHA from
  that ref, never a hardcoded "main". _on_load's retry path re-diffs
  instead of re-pinning the same stale SHA, so a blob-mismatch refusal
  can't loop forever.
- source="main" now diffs against the last catalog a maintainer actually
  SIGNED (walking catalog.json's git history until a version verifies
  against the current .sig), not against itself.
- Replaced the theatre-only test_no_acknowledge_all_function_exists (only
  asserted no function was *named* acknowledge_all) with a test that also
  exercises the real gate. Added can_sign/sign_precondition coverage for
  the empty-diff, blocking-risk, and ref-resolution seams -- each verified
  to fail when its guard is removed.

Finding 5 -- the catalog key and release key were the same CI-resident key:
- scripts/sign_checksums.py gets its own RELEASE_PUBKEYS (separate from
  bcc_core.CATALOG_PUBKEYS) and a verify_checksums_against_any() helper.
- release.yml's signing-smoke-test now verifies RELEASE_SIGNING_KEY against
  RELEASE_PUBKEYS only -- it no longer imports bcc_core/CATALOG_PUBKEYS at
  all, so this workflow can never compare a CI secret against the
  catalog's root of trust.
- catalog_console.py: keygen/show-seed-b64 gain --release, with separate
  keychain/file storage per key kind. show-seed-b64 refuses to run without
  --release, so the catalog seed can't be exported to a CI secret by habit.
- README documents both keys' trust properties and the asymmetry: a CI
  compromise burns the release key, never the catalog key.

The maintainer must rotate the catalog key (it was CI-resident, so treat it
as burned for catalog use) and generate a fresh release key -- see the PR
description for the exact steps. No key is generated or committed here.

.github/workflows/release.yml

@@ -101,9 +101,20 @@ jobs:
   # signing step — which means a wrong/missing RELEASE_SIGNING_KEY secret
   # would only be discovered at the worst possible moment: during a real
   # release. This job signs a throwaway manifest with the secret and verifies
-  # the result against the PUBLIC key already compiled into bcc_core.
+  # the result against scripts/sign_checksums.RELEASE_PUBKEYS.
   #
-  # It proves the two halves of the keypair actually match, without
+  # IMPORTANT (issue #68 finding 5): this must verify against the RELEASE
+  # public key, never bcc_core.CATALOG_PUBKEYS. The catalog key is the
+  # offline, maintainer-held root of trust for what BCC executes; it must
+  # NEVER be compared against a value that lives in a CI secret, because
+  # that comparison is itself a way to smuggle a catalog-trusted key through
+  # CI review ("does this repo secret match the catalog key" is a question
+  # this workflow must never even ask). The release key is a SEPARATE
+  # keypair, generated via `catalog_console.py keygen --release`, that only
+  # ever signs release SHA256SUMS manifests -- a CI/secret compromise burns
+  # this key, not the catalog key.
+  #
+  # It proves the two halves of the RELEASE keypair actually match, without
   # publishing anything. Run it from the Actions tab after setting or
   # rotating the secret.
   signing-smoke-test:
@@ -120,42 +131,54 @@ jobs:
       - name: Install dependencies
         run: pip install cryptography
 
-      - name: Sign a throwaway manifest and verify against the shipped pubkey
+      - name: Sign a throwaway manifest and verify against the RELEASE pubkey
         env:
           RELEASE_SIGNING_KEY: ${{ secrets.RELEASE_SIGNING_KEY }}
         run: |
           if [ -z "$RELEASE_SIGNING_KEY" ]; then
             echo "FAIL: RELEASE_SIGNING_KEY secret is not set."
-            echo "Generate it with: python catalog_console.py show-seed-b64"
-            echo "then add it under Settings -> Actions -> Secrets."
+            echo "Generate the RELEASE key (NOT the catalog key) with:"
+            echo "    python catalog_console.py keygen --release"
+            echo "then add its seed under Settings -> Actions -> Secrets, via:"
+            echo "    python catalog_console.py show-seed-b64 --release"
             exit 1
           fi
           mkdir -p smoke && echo "smoke test payload" > smoke/hello.txt
           python3 scripts/sign_checksums.py generate smoke --out smoke/SHA256SUMS
           python3 scripts/sign_checksums.py sign --sums smoke/SHA256SUMS --out smoke/SHA256SUMS.sig
           python - <<'PY'
-          import base64, pathlib, sys
-          import bcc_core as c
-          from scripts.sign_checksums import verify_checksums
+          import pathlib, sys
+          from scripts.sign_checksums import RELEASE_PUBKEYS, verify_checksums_against_any
 
-          # The public half that ships inside the binary. If the secret is a
-          # DIFFERENT key than the one users' copies trust, this fails here --
-          # which is the entire point of the job.
-          pub_b64 = base64.b64encode(c.CATALOG_PUBKEYS[0]).decode()
+          # Deliberately does NOT import bcc_core / CATALOG_PUBKEYS at all --
+          # this smoke test must never be able to compare the CI secret
+          # against the catalog's root of trust (issue #68 finding 5). Only
+          # RELEASE_PUBKEYS (scripts/sign_checksums.py) is a legitimate
+          # target for a CI-resident key.
+          if not RELEASE_PUBKEYS:
+              sys.exit(
+                  "FAIL: scripts/sign_checksums.RELEASE_PUBKEYS is empty.\n"
+                  "\n"
+                  "Generate the release keypair with:\n"
+                  "    python catalog_console.py keygen --release\n"
+                  "then paste the printed public key into RELEASE_PUBKEYS in\n"
+                  "scripts/sign_checksums.py and commit that change."
+              )
 
           sums = pathlib.Path("smoke/SHA256SUMS").read_text()
           sig = pathlib.Path("smoke/SHA256SUMS.sig").read_bytes()
 
-          if not verify_checksums(pub_b64, sums, sig):
+          if not verify_checksums_against_any(RELEASE_PUBKEYS, sums, sig):
               sys.exit(
                   "FAIL: the signature produced by RELEASE_SIGNING_KEY does NOT verify\n"
-                  "against the public key in bcc_core.CATALOG_PUBKEYS.\n"
+                  "against any key in scripts/sign_checksums.RELEASE_PUBKEYS.\n"
                   "\n"
-                  "The secret and the shipped public key are different keypairs. Users\n"
-                  "would reject every signature this CI produces. Re-copy the seed from\n"
-                  "`catalog_console.py show-seed-b64`, or update CATALOG_PUBKEYS."
+                  "The secret and the shipped release public key are different keypairs.\n"
+                  "Downloaders would reject every signature this CI produces. Re-copy the\n"
+                  "seed from `catalog_console.py show-seed-b64 --release`, or update\n"
+                  "RELEASE_PUBKEYS with the matching public key."
               )
-          print("OK: RELEASE_SIGNING_KEY matches the public key shipped in bcc_core.")
+          print("OK: RELEASE_SIGNING_KEY matches a key in RELEASE_PUBKEYS.")
           PY
 
   # ── Create GitHub Release with all three artifacts ──────────────────────
@@ -206,9 +229,13 @@ jobs:
       # checks. It does NOT remove Gatekeeper/SmartScreen warnings.
       #
       # The private key is a repo secret (RELEASE_SIGNING_KEY, base64 raw
-      # Ed25519 seed) generated via the Catalog Console (#62). If it's not
-      # set, we still publish the release — just without a .sig — rather
-      # than fail the release outright.
+      # Ed25519 seed) for the RELEASE key -- a SEPARATE keypair from the
+      # catalog key, generated via `python catalog_console.py keygen
+      # --release` (issue #68 finding 5; #62). This key is intentionally
+      # CI-resident and signs ONLY this checksum manifest; it is never
+      # trusted to sign data/catalog.json. If it's not set, we still
+      # publish the release — just without a .sig — rather than fail the
+      # release outright.
       - name: Check for signing key
         id: signing
         run: |
@@ -234,7 +261,7 @@ jobs:
       - name: Warn — release will be unsigned
         if: steps.signing.outputs.has_key != 'true'
         run: |
-          echo "::warning::RELEASE_SIGNING_KEY secret is not set — this release is being published WITHOUT a signed SHA256SUMS.sig. Add the secret (base64 raw Ed25519 seed, generated via the Catalog Console, #62) before the next tag."
+          echo "::warning::RELEASE_SIGNING_KEY secret is not set — this release is being published WITHOUT a signed SHA256SUMS.sig. Generate the RELEASE key (python catalog_console.py keygen --release) and add its seed (python catalog_console.py show-seed-b64 --release) as this secret before the next tag."
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2