feat(blueprints): publishing the gallery as signed files (T79a)

[haiquang9994]

Roadmap task T79a. T78a minted a key for blueprints and taught blueprint.import to check it; T79 then compiled the gallery into the binary and trusted it without a signature — correctly — which removed the channel those signatures were for. This restores it: the six manifests published from mixengine-packages as <slug>.toml with a .minisig beside each, under a moved blueprints tag, so a blueprint downloaded by hand lands trusted.

Design: docs/superpowers/specs/2026-09-02-t79a-signed-gallery-publication-design.md.

What is in this repository

One behaviour change, and it is what the task found. [blueprint] name is display text — the gallery says Laravel, Next.js, Static site — and import with no --name filed a blueprint under exactly that string, so validated_slug refused every gallery file before the signature was ever reached. The headline of this task was broken for all six. A file is now filed under its own stem, which is also the only fallback that round-trips this product's own output, since everything it renders is written as <slug>.toml. T78a's test never saw it: its fixture is borrowed.toml named borrowed.

Two tests: the daemon walks the whole gallery and imports each rendering by hand, and a core-level one holds the display names to not being slugs, so the first cannot pass for a reason that has stopped being true.

What is in mixengine-packages

Already on its master and already run:

• publish-blueprints.yml — checks out this repository at a ref (no manifest is ever copied over there), proves blueprints.pub against the compiled-in blueprints::trust::PUBLIC_KEY before signing, signs, verifies, uploads, prunes assets the gallery no longer contains, then downloads what it just published and verifies that.
• tools/blueprints.py, release/publish-blueprints.sh, check-blueprints.yml (weekly drift check, run and green).

Verified on a real machine

Against the published files, with a daemon built from this branch:

• mix blueprint import laravel.toml --overwrite → imported laravel — signed by the gallery key
• one byte appended → untrusted
• signature removed → untrusted

--overwrite only because every home already holds the built-in six; a slug a build does not carry needs no flag.

Follow-up

T79b is added to the roadmap: a failed signature and no signature at all produce the same line in the client today, and they are not the same event.