Fix audit findings: bakery index signing, artifact checksums, stale theme docs

- Add minisign-based signing/verification for the bakery index:
  scripts/gen-index.sh signs index.json (MINISIGN_SEC_KEY env var, dormant
  no-op with a loud warning until a key is provisioned); bakery/src/manifest.rs
  fetches index.json.minisig and verifies it with minisign-verify against a
  hardcoded PUBKEY before parsing/caching, and re-verifies the cached copy
  on every load (falls back to one re-fetch if the cache predates signing
  or fails verification; a fresh fetch that fails verification is a hard
  error).
- Close the previously-unchecksummed config-example and systemd-unit
  downloads in bakery/src/install.rs (scaffold_config, install_service):
  index.json now carries `sha256`/`example_sha256` for these artifacts
  (computed in gen-index.sh), verified via the same download::verify_sha256
  used for binaries. Downloads without a matching sha256 in the index are
  refused rather than installed unverified.
- scripts/get.sh now verifies the bakery release binary itself against a
  pinned minisign public key before installing it (falls back to the
  existing sha256-only check with a loud warning if no .minisig is
  published yet or minisign isn't installed; a present-but-invalid
  signature is a hard failure).
- Add dormant "sign release binary" steps to the bakery and bread-theme
  release workflows (.github/workflows/release.yml,
  .forgejo/workflows/release-bread-theme.yml), gated on secrets that are
  not yet configured — binaries ship unsigned exactly as before until the
  owner wires up the secret.
- .gitignore: add *.minisign-sec / minisign.key so the signing key can
  never be committed by accident.
- bread-theme: fix stale docs describing a "Catppuccin Mocha fallback"
  (BREAD_DESIGN_SYSTEM.md, README.md, Cargo.toml/bakery.toml/registry
  descriptions) — the actual implementation (palette.rs) uses a fixed BOS
  dark base with only accent colors from pywal.
- bread-theme: fix the legacy css_vars() path, which had its own
  hand-written @define-color block that predated the `accent` and computed
  `on-*` ink colors used by the rest of the stylesheet — any caller whose
  CSS referenced those names against css_vars()'s output would hit
  undefined colors (the illegible-text bug). css_vars() now delegates to
  the same define_colors() the full stylesheet uses, so the two can't
  drift apart again.

BREAD_DESIGN_SYSTEM.md

@@ -48,16 +48,27 @@ Establish a visual hierarchy with consistent rounding:
 
 ## Color System
 
-All projects use **pywal dynamic theming** with **Catppuccin Mocha** as the fallback palette:
+All projects use **pywal dynamic theming** for accents, layered on a **fixed BOS
+dark base** — background, surface, overlay, and foreground never come from
+pywal, only the accent slots (color1–6) track the current wallpaper:
 
-- **Background**: `#1e1e2e` (Catppuccin)
-- **Foreground**: `#cdd6f4` (Catppuccin)
-- **Surface**: `#181825` (Catppuccin)
-- **Accent**: Dynamic (from pywal)
+- **Background**: `#0c0c0c` (fixed)
+- **Foreground**: `#e8e8e8` (fixed)
+- **Surface**: `#1a1a1a` (fixed, `color0`)
+- **Overlay**: `#d8d8d8` (fixed, `color7`)
+- **Accent**: Dynamic (from pywal `color4`), with curated bread-toned defaults
+  before any wallpaper has been set
+
+Without pinning bg/surface/overlay, a light or muddy-toned wallpaper makes
+pywal hand back a light or off-hue background, and every bread GUI's panels
+inherit it — see `bread-theme/src/palette.rs` for the implementation.
 
 Color palette slots (via wal):
-- color0–color7: ANSI colors
+- color0–color7: ANSI colors (0 and 7 fixed, 1–6 pywal-derived)
 - Semantic: red, green, yellow, blue, pink, teal
+- Computed ink: `on-bg`, `on-surface`, `on-accent`, `on-red`, `on-overlay` —
+  black or white text, whichever is legible against that background (see
+  `bread_theme::ink_on`)
 
 ## Component Standards
 
@@ -104,8 +115,9 @@ add only app-specific rules:
   hardcoded Nord palette; migrated to the shared stylesheet).
 - **breadcrumbs** — CLI tool; ANSI colours only, no GUI styling.
 
-> Palette note: the fallback is Catppuccin Mocha, but installs (e.g. BOS) drive
-> the real palette from pywal — BOS ships a black-base palette.
+> Palette note: background/surface/overlay/foreground are a fixed BOS dark
+> base, never pywal-derived; only the accent slots (color1–6) track the
+> current wallpaper via pywal.
 
 ## Future Consistency Checks