ci: sign [breadway] repo as the runner user

Docker as root left 0600 .sig files the runner could not chmod
(run 1050), so publish_tree never moved the tree into
/srv/breadway-dl/arch/x86_64. Sign as the host uid so nginx can
read the files and the next publish can replace them.

docs/signed-repo.md

@@ -74,7 +74,7 @@ Pacman fetches `<section>.db` + `<section>.db.sig` from `Server`.
 ## Dispatch the workflow
 
 Forgejo UI: **Actions → "Publish signed [breadway] repo" → Run workflow**.
-Select this branch (`feature/signed-repo`) until it is on `main`.
+Select `main`.
 
 API (`workflow_dispatch`):
 
@@ -83,11 +83,9 @@ curl -fsS -X POST \
   -H "Authorization: token ${RELEASE_TOKEN}" \
   -H "Content-Type: application/json" \
   "https://git.breadway.dev/api/v1/repos/Breadway/bos/actions/workflows/signed-repo.yml/dispatches" \
-  -d '{"ref":"feature/signed-repo"}'
+  -d '{"ref":"main"}'
 ```
 
-After merge, use `"ref":"main"`.
-
 It also runs after the in-repo AUR republish workflows complete
 (`calamares` / `bibata` / `powerlevel10k` / `yay-bin`). breadlock lives in
 another repo; that job can fire this one with `repository_dispatch` event
@@ -151,5 +149,5 @@ and the verify commands above succeed:
 3. Only then flip that section to `SigLevel = Required`.
 
 Do not do those three steps against Forgejo's registry. See
-`iso/pacman.conf` and `iso/airootfs/etc/pacman.conf`. This branch does
+`iso/pacman.conf` and `iso/airootfs/etc/pacman.conf`. This tree does
 **not** change either file.

scripts/ci-publish-signed-repo.sh

@@ -81,6 +81,8 @@ repo_add_signed() {
   fi
   [[ -e breadway.db.tar.gz.sig || -e breadway.db.sig ]] \
     || die "repo-add -s did not write breadway.db*.sig"
+  # gpg writes 0600; nginx and the next publish need world-readable files.
+  find . -maxdepth 1 -type f -exec chmod a+r {} + || true
 }
 
 ensure_arch_tools() {
@@ -125,7 +127,12 @@ sign_and_index_anywhere() {
   rt="$(container_runtime)" || die \
     "need host gpg+repo-add, or docker/podman to run archlinux:latest (no Forgejo container: — host must see /srv/breadway-dl)"
   # Host job + bind-mount, same reason bakery writes /srv without container:.
+  # Run as the runner user: root-owned 0600 .sig files made chmod/nginx fail
+  # (run 1050) and would block the next `rm -rf` of a previous tree.
   "$rt" run --rm --network=host \
+    --user "$(id -u):$(id -g)" \
+    -e HOME=/tmp \
+    -e TMPDIR=/tmp \
     -e GPG_PRIVATE_KEY \
     -e BREADWAY_SIGN_ONLY=1 \
     -e BREADWAY_REPO_DIR=/repo \