Fix audit findings: bakery index signing, artifact checksums, stale theme docs

- Add minisign-based signing/verification for the bakery index:
  scripts/gen-index.sh signs index.json (MINISIGN_SEC_KEY env var, dormant
  no-op with a loud warning until a key is provisioned); bakery/src/manifest.rs
  fetches index.json.minisig and verifies it with minisign-verify against a
  hardcoded PUBKEY before parsing/caching, and re-verifies the cached copy
  on every load (falls back to one re-fetch if the cache predates signing
  or fails verification; a fresh fetch that fails verification is a hard
  error).
- Close the previously-unchecksummed config-example and systemd-unit
  downloads in bakery/src/install.rs (scaffold_config, install_service):
  index.json now carries `sha256`/`example_sha256` for these artifacts
  (computed in gen-index.sh), verified via the same download::verify_sha256
  used for binaries. Downloads without a matching sha256 in the index are
  refused rather than installed unverified.
- scripts/get.sh now verifies the bakery release binary itself against a
  pinned minisign public key before installing it (falls back to the
  existing sha256-only check with a loud warning if no .minisig is
  published yet or minisign isn't installed; a present-but-invalid
  signature is a hard failure).
- Add dormant "sign release binary" steps to the bakery and bread-theme
  release workflows (.github/workflows/release.yml,
  .forgejo/workflows/release-bread-theme.yml), gated on secrets that are
  not yet configured — binaries ship unsigned exactly as before until the
  owner wires up the secret.
- .gitignore: add *.minisign-sec / minisign.key so the signing key can
  never be committed by accident.
- bread-theme: fix stale docs describing a "Catppuccin Mocha fallback"
  (BREAD_DESIGN_SYSTEM.md, README.md, Cargo.toml/bakery.toml/registry
  descriptions) — the actual implementation (palette.rs) uses a fixed BOS
  dark base with only accent colors from pywal.
- bread-theme: fix the legacy css_vars() path, which had its own
  hand-written @define-color block that predated the `accent` and computed
  `on-*` ink colors used by the rest of the stylesheet — any caller whose
  CSS referenced those names against css_vars()'s output would hit
  undefined colors (the illegible-text bug). css_vars() now delegates to
  the same define_colors() the full stylesheet uses, so the two can't
  drift apart again.

README.md

@@ -36,7 +36,9 @@ to keys.
 ## Theming
 
 All GUIs share one look via `bread-theme`. The `bread-theme` CLI renders the
-component stylesheet from your pywal palette (Catppuccin Mocha fallback) to
+component stylesheet from your pywal palette, layered on a fixed BOS dark
+base (background/surface/overlay never come from pywal — only the accent
+colors do, so a light wallpaper can't wash out the UI), to
 `$XDG_RUNTIME_DIR/bread/theme.css`; every app loads that file and **live-reloads**
 it, so changing your wallpaper recolours the whole ecosystem with no rebuilds:
 
@@ -95,8 +97,12 @@ Install all required deps with `sudo pacman -S <packages>`. Use `pacman -Q <pkg>
 ## Theming
 
 All GUI products (breadbar, breadbox, breadpad) read pywal colors from
-`~/.cache/wal/colors.json` and fall back to Catppuccin Mocha when that file
-is absent. Per-app CSS overrides live at `~/.config/<app>/style.css`.
+`~/.cache/wal/colors.json` for accents only; background, surface, overlay,
+and foreground are always BOS's fixed dark values (see
+[`BREAD_DESIGN_SYSTEM.md`](BREAD_DESIGN_SYSTEM.md#color-system)) regardless
+of what pywal extracted from the wallpaper. When `colors.json` is absent,
+accents fall back to BOS's curated bread-toned defaults. Per-app CSS
+overrides live at `~/.config/<app>/style.css`.
 
 The shared theming logic lives in the `bread-theme` crate in this repo.
 
@@ -107,7 +113,7 @@ This repo is a Cargo workspace:
 ```
 bread-ecosystem/
 ├── bakery/          # package manager binary
-├── bread-theme/     # shared pywal + Catppuccin theming crate
+├── bread-theme/     # shared pywal + fixed-dark-base theming crate
 ├── registry/        # bread-ecosystem.toml — product registry
 └── scripts/
     ├── get.sh       # curl | sh bootstrap