release: pin exact GPG signing subkey

[3leapsdave]

Summary

• require an exact GPG signing-subkey selector ending in !
• retain a separate full primary fingerprint as the independent authorization boundary
• verify the selected subkey capability, lifecycle state, parent relationship, and resulting tag signature
• document a generic maintainer procedure for discovering primary and signing-subkey identifiers
• expand hermetic release controls from 52 to 66 cases

Why

Selecting a primary key leaves GnuPG free to choose among eligible signing subkeys. Pins execution to the maintainer-selected signing subkey while separately proving that it belongs to the authorized primary.

Fail-closed coverage

• rejects missing exact-selection syntax, primary-key selectors, ambiguous or missing subkeys, and non-signing or expired subkeys
• rejects disabled markers on either the selected subkey or its parent primary
• rejects a valid same-UID signing subkey under a different primary
• binds VALIDSIG to both the exact selected subkey and independent authorized primary
• preserves the literal release-commit handoff, direct annotated-tag target, tagger identity, policy attestation, guarded push, and hosted verification

Validation

• DECERNOR_BIN=/absolute/path/to/decernor make check-all
• make release-control-test — 66 hermetic controls
• macOS /bin/bash 3.2 syntax and runtime
• ShellCheck
• live version-tag ruleset validation
• real committed-public-key selector resolution
• git diff --check

No release tag or GitHub release is created by this pull request.