docs: document new PKI code-signing method for server v11

[DeepDiver1975]

Summary

ownCloud Classic 11 replaces the legacy occ integrity:sign-app flow with a new PKI-based code-signing system, built from two repositories:

• owncloud/ocsign — standalone Go CLI that produces appinfo/signature.json without a running ownCloud instance.
• owncloud/developer-certificates — the PKI: certificate-request intake (issue form + repo-control challenge), public issuance ledger, CRL, and revocation.

Third-party app signing becomes mandatory on v11+: unsigned or invalidly-signed apps are blocked on install/update/enable (not merely warned).

Changes

• Rewrite the developer Code Signing page around the new PKI: certificate request (CSR → issue form → .well-known challenge), signing with ocsign (flags + exit codes), Mode-2 attestation marked planned / not yet available, renew/revoke (CMS + VDP), legacy transition note (pre-2026 signatures accepted with a warning until 2026-12-31), and refreshed error list.
• Admin Code Signing page: correct "optional" → mandatory on v11+, add PKI/CRL verification, per-app disable escape hatch and git-channel exemption; remediation section and its #fixing-invalid-code-integrity-messages anchor kept intact.
• Mark occ integrity:sign-app / integrity:sign-core deprecated in favour of ocsign; keep check-*.
• Surface the signing requirement on the Marketplace publishing page (previously unmentioned).

Notes

• Mode-2 attestation and the developer-certificates repo links are documented now but go live at the v11 release; some links may 404 until then.
• A companion update to owncloud/developer-certificates/docs/developer-guide.md (cross-linking back here) is intended as a separate PR once that repo is public.

Verification

• Local Antora build is clean for all four pages; only pre-existing migrating_to_ocis.adoc cross-component xref errors remain (present on master).
• Confirmed in built HTML: all internal anchors and cross-page xrefs (dev→admin, publishing→signing, occ deprecation note) resolve; no unresolved xref markers.

🤖 Generated with Claude Code

[DeepDiver1975]

Code Review

Docs-only PR (4 files, +298/−159) rewriting the code-signing docs for the ownCloud 11 move from occ integrity:sign-app to the PKI-based ocsign flow. Coherent, well-structured, and the description matches the diff.

Correctness & consistency ✅

Verified against the checkout:

• Internal anchors resolve — xref:legacy-signatures[] → [#legacy-signatures] and xref:mode-2-attestation[] → [#mode-2-attestation] both match.
• Cross-page xrefs resolve — dev→admin (#fixing-invalid-code-integrity-messages), publishing→signing, and the occ deprecation note all target existing files/anchors. xref:errors[here] in the admin file is pre-existing and untouched.
• Attributes exist — {oc-marketplace-url} in global-attributes.yml; :ocsign-repo-url: / :developer-certificates-url: defined in the page header.
• :toc: right matches project convention (used in 164 module files).
• The "mandatory on v11+" message and the 2026-12-31 legacy cutoff are stated consistently across all four pages.

Notes

• EXTRA_FILE wording (thanks @phil-davis) — fixed in b9e017c: EXTRA_FILE means a file is present on disk but not listed in signature.json (an added file); a removed file is FILE_MISSING. Dropped "or removed".
• Marketplace URL rendering (nit) — the rewritten dev page uses {oc-marketplace-url}[...] (no trailing slash) while the rest of the repo uses {oc-marketplace-url}/[...]. Both render fine since the attribute has no trailing slash, but /[...] matches the existing idiom.
• Pre-release links — Mode 2 attestation is clearly marked Planned / not yet available, and some developer-certificates links may 404 until the v11 release (flagged in the PR body). Since master maps to the published next site, worth confirming with the team whether exposing 404-prone links now is acceptable or should be gated to the release branch. Not a correctness defect.

Risks

Low. Docs-only, no build/extension changes. Primary risk is the intentional pre-release link/feature exposure, already surfaced by the author.

Verdict

Approve. Well-organized rewrite; all anchors, xrefs, and attributes verified to resolve in this checkout.