Fix audit findings: bakery index signing, artifact checksums, stale theme docs

- Add minisign-based signing/verification for the bakery index:
  scripts/gen-index.sh signs index.json (MINISIGN_SEC_KEY env var, dormant
  no-op with a loud warning until a key is provisioned); bakery/src/manifest.rs
  fetches index.json.minisig and verifies it with minisign-verify against a
  hardcoded PUBKEY before parsing/caching, and re-verifies the cached copy
  on every load (falls back to one re-fetch if the cache predates signing
  or fails verification; a fresh fetch that fails verification is a hard
  error).
- Close the previously-unchecksummed config-example and systemd-unit
  downloads in bakery/src/install.rs (scaffold_config, install_service):
  index.json now carries `sha256`/`example_sha256` for these artifacts
  (computed in gen-index.sh), verified via the same download::verify_sha256
  used for binaries. Downloads without a matching sha256 in the index are
  refused rather than installed unverified.
- scripts/get.sh now verifies the bakery release binary itself against a
  pinned minisign public key before installing it (falls back to the
  existing sha256-only check with a loud warning if no .minisig is
  published yet or minisign isn't installed; a present-but-invalid
  signature is a hard failure).
- Add dormant "sign release binary" steps to the bakery and bread-theme
  release workflows (.github/workflows/release.yml,
  .forgejo/workflows/release-bread-theme.yml), gated on secrets that are
  not yet configured — binaries ship unsigned exactly as before until the
  owner wires up the secret.
- .gitignore: add *.minisign-sec / minisign.key so the signing key can
  never be committed by accident.
- bread-theme: fix stale docs describing a "Catppuccin Mocha fallback"
  (BREAD_DESIGN_SYSTEM.md, README.md, Cargo.toml/bakery.toml/registry
  descriptions) — the actual implementation (palette.rs) uses a fixed BOS
  dark base with only accent colors from pywal.
- bread-theme: fix the legacy css_vars() path, which had its own
  hand-written @define-color block that predated the `accent` and computed
  `on-*` ink colors used by the rest of the stylesheet — any caller whose
  CSS referenced those names against css_vars()'s output would hit
  undefined colors (the illegible-text bug). css_vars() now delegates to
  the same define_colors() the full stylesheet uses, so the two can't
  drift apart again.

.github/workflows/release.yml

@@ -36,8 +36,41 @@ jobs:
           cp bakery.toml "${PKG_DIR}/bakery.toml"
           ln -sfn "${VERSION}" "${DL_DIR}/bakery/latest"
 
+      # Signs the bakery binary itself with the same minisign key that signs
+      # index.json (get.sh pins the matching public key). Dormant until the
+      # BAKERY_MINISIGN_SEC_KEY secret is actually provisioned in this repo's
+      # Actions settings — until then this step logs a warning and the
+      # binary ships unsigned, exactly as it does today.
+      - name: sign release binary
+        env:
+          MINISIGN_SEC_KEY_CONTENTS: ${{ secrets.BAKERY_MINISIGN_SEC_KEY }}
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          PKG_DIR="${DL_DIR}/bakery/${VERSION}"
+          if [ -n "${MINISIGN_SEC_KEY_CONTENTS}" ]; then
+            command -v minisign >/dev/null 2>&1 || { echo "::error::minisign not installed on runner"; exit 1; }
+            KEY_FILE="$(mktemp)"
+            trap 'shred -u "${KEY_FILE}" 2>/dev/null || rm -f "${KEY_FILE}"' EXIT
+            printf '%s' "${MINISIGN_SEC_KEY_CONTENTS}" > "${KEY_FILE}"
+            minisign -W -S -s "${KEY_FILE}" -m "${PKG_DIR}/bakery-x86_64" \
+              -x "${PKG_DIR}/bakery-x86_64.minisig" </dev/null
+            echo "signed bakery-x86_64"
+          else
+            echo "::warning::BAKERY_MINISIGN_SEC_KEY secret not set — shipping bakery-x86_64 UNSIGNED"
+          fi
+
       - name: regenerate index.json
-        run: bash "${GITHUB_WORKSPACE}/scripts/gen-index.sh"
+        env:
+          MINISIGN_SEC_KEY_CONTENTS: ${{ secrets.BAKERY_MINISIGN_SEC_KEY }}
+        run: |
+          if [ -n "${MINISIGN_SEC_KEY_CONTENTS}" ]; then
+            KEY_FILE="$(mktemp)"
+            trap 'shred -u "${KEY_FILE}" 2>/dev/null || rm -f "${KEY_FILE}"' EXIT
+            printf '%s' "${MINISIGN_SEC_KEY_CONTENTS}" > "${KEY_FILE}"
+            MINISIGN_SEC_KEY="${KEY_FILE}" bash "${GITHUB_WORKSPACE}/scripts/gen-index.sh"
+          else
+            bash "${GITHUB_WORKSPACE}/scripts/gen-index.sh"
+          fi
 
       - name: upload to GitHub Release
         env:
@@ -47,7 +80,6 @@ jobs:
           PKG_DIR="${DL_DIR}/bakery/${VERSION}"
           gh release create "${GITHUB_REF_NAME}" \
             --title "bakery v${VERSION}" --generate-notes 2>/dev/null || true
-          gh release upload "${GITHUB_REF_NAME}" \
-            "${PKG_DIR}/bakery-x86_64" \
-            "${PKG_DIR}/bakery-x86_64.sha256" \
-            --clobber
+          ASSETS="${PKG_DIR}/bakery-x86_64 ${PKG_DIR}/bakery-x86_64.sha256"
+          [ -f "${PKG_DIR}/bakery-x86_64.minisig" ] && ASSETS="${ASSETS} ${PKG_DIR}/bakery-x86_64.minisig"
+          gh release upload "${GITHUB_REF_NAME}" ${ASSETS} --clobber