repo-add -s already wrote the signed db; chmod a+r on .sig files returned EPERM and rolled back the stage dir.
Host job on hestia (no container) collects breadlock plus the ISO AUR republishes from the Forgejo registry, detach-signs them, repo-add -s, and writes /srv/breadway-dl/arch/x86_64/. ISO SigLevel stays Never.