ci: fail fast on missing signing key when regenerating index.json

The remote gen-index.sh call never had MINISIGN_SEC_KEY wired through, so a
missing/misconfigured secret silently produced an unsigned index.json that
overwrote the previously-signed one instead of failing the job — this is
why bread's dev track never appeared in dl.breadway.dev/dev/index.json
after the first dev-release.yml run despite it reporting success.

.forgejo/workflows/beta-release.yml

@@ -42,8 +42,14 @@ jobs:
       # No GitHub Release upload — beta, like dev, is only distributed via
       # dl.breadway.dev/beta/.
       - name: regenerate beta index.json
+        env:
+          MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
         run: |
           set -euo pipefail
+          if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
+            echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate beta index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the beta track)"
+            exit 1
+          fi
           rm -rf /tmp/bread-ecosystem-ci
           git clone https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
           TRACK=beta bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh

.forgejo/workflows/dev-release.yml

@@ -56,8 +56,14 @@ jobs:
       # spam a release per commit, so dl.breadway.dev/dev/ is the only
       # distribution point for this track.
       - name: regenerate dev index.json
+        env:
+          MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
         run: |
           set -euo pipefail
+          if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
+            echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate dev index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the dev track)"
+            exit 1
+          fi
           rm -rf /tmp/bread-ecosystem-ci
           git clone https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
           TRACK=dev bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh

.forgejo/workflows/release.yml

@@ -38,8 +38,14 @@ jobs:
           ln -sfn "${VERSION}" "/srv/breadway-dl/bread/latest"
 
       - name: regenerate index.json
+        env:
+          MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
         run: |
           set -euo pipefail
+          if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
+            echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone)"
+            exit 1
+          fi
           rm -rf /tmp/bread-ecosystem-ci
           git clone https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
           bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh