bakery: rotate signing key, fix broken index-signature verification

The old bakery-signing-key.minisign-sec on hestia was password-encrypted
and the password was lost, so scripts/gen-index.sh never actually signed
index.json (silent no-op warning). bakery/src/manifest.rs (0.3.0+) hard-
requires that signature, so every bakery command has been failing with
'fetching index.json.minisig — the index must be signed before it can be
trusted' since the signing enforcement shipped.

Generated a new no-password minisign keypair on hestia
(~/.secrets/bakery-signing-key-2.minisign-sec), updated the hardcoded
PUBKEY in manifest.rs and get.sh to match, wired
BAKERY_MINISIGN_SEC_KEY_PATH as a Forgejo Actions secret so future CI
releases sign automatically, and manually signed+published the current
index.json on hestia so bakery works immediately.

Cargo.lock

@@ -104,7 +104,7 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "bakery"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "anyhow",
  "chrono",
@@ -149,7 +149,7 @@ dependencies = [
 
 [[package]]
 name = "bread-onnx"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "anyhow",
  "bread-utils",
@@ -175,7 +175,7 @@ dependencies = [
 
 [[package]]
 name = "bread-theme"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "dirs",
  "gtk4",
@@ -185,7 +185,7 @@ dependencies = [
 
 [[package]]
 name = "bread-utils"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "bread-shared",
  "dirs",