ci: sign [breadway] repo as the runner user

Docker as root left 0600 .sig files the runner could not chmod
(run 1050), so publish_tree never moved the tree into
/srv/breadway-dl/arch/x86_64. Sign as the host uid so nginx can
read the files and the next publish can replace them.

docs/signed-repo.md

@@ -74,7 +74,7 @@ Pacman fetches `<section>.db` + `<section>.db.sig` from `Server`.
 ## Dispatch the workflow
 
 Forgejo UI: **Actions → "Publish signed [breadway] repo" → Run workflow**.
-Select this branch (`feature/signed-repo`) until it is on `main`.
+Select `main`.
 
 API (`workflow_dispatch`):
 
@@ -83,11 +83,9 @@ curl -fsS -X POST \
   -H "Authorization: token ${RELEASE_TOKEN}" \
   -H "Content-Type: application/json" \
   "https://git.breadway.dev/api/v1/repos/Breadway/bos/actions/workflows/signed-repo.yml/dispatches" \
-  -d '{"ref":"feature/signed-repo"}'
+  -d '{"ref":"main"}'
 ```
 
-After merge, use `"ref":"main"`.
-
 It also runs after the in-repo AUR republish workflows complete
 (`calamares` / `bibata` / `powerlevel10k` / `yay-bin`). breadlock lives in
 another repo; that job can fire this one with `repository_dispatch` event
@@ -151,5 +149,5 @@ and the verify commands above succeed:
 3. Only then flip that section to `SigLevel = Required`.
 
 Do not do those three steps against Forgejo's registry. See
-`iso/pacman.conf` and `iso/airootfs/etc/pacman.conf`. This branch does
+`iso/pacman.conf` and `iso/airootfs/etc/pacman.conf`. This tree does
 **not** change either file.