ci: sign plugins-index.json in-repo, drop worker signing dependency

Pair with the worker-side simplification on the librefang PR — the
worker is now a pure transport (no key material, no signing) and this
repo's CI takes over signature production.

scripts/sign-plugins-index.mjs reads REGISTRY_PRIVATE_KEY from a GitHub
Actions secret, signs plugins-index.json with Ed25519, and writes
plugins-index.json.sig alongside it. Aborts loudly when the secret is
missing so a misconfigured CI can't silently ship an unsigned payload.

The workflow now runs build → sign → commit (.json + .sig) → push →
poke worker /refresh. The worker fetches the committed .json + .sig
verbatim and stores both — the daemon then verifies against the
embedded pubkey it ships with.

Closes PR review CRITICAL #1: the worker is no longer a sign-anything
oracle reachable via REGISTRY_REFRESH_TOKEN. Trust root is now this
repo's branch protection + Actions secret scope, not a token any CI
job that can talk to stats.librefang.ai can use to mint signatures.

Note: the keypair was rotated as part of this change (PR not yet
merged so no daemon TOFU pins exist). New pubkey:
  ClGa0Ucap8NdrKAy1rw9Tt6A9I8eg4zJ53+xIuKMuq0=
The plugins-index.json.sig committed here is signed with the matching
new private key, in lockstep with the daemon EMBEDDED_REGISTRY_PUBKEY
constant and all three worker [vars] entries.

scripts/sign-plugins-index.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+// Sign plugins-index.json with the registry's Ed25519 private key and
+// commit the .sig alongside the JSON. Pair with build-plugins-index.mjs
+// (which produces the bytes) — this script's only job is to attach a
+// detached signature.
+//
+// Run by .github/workflows/refresh-cache.yml. Reads the PKCS#8-base64
+// private key from the REGISTRY_PRIVATE_KEY env var (set as a GitHub
+// Actions repo secret); aborts loudly if the secret is missing or
+// malformed so a misconfigured CI run can't silently ship an unsigned
+// index.
+//
+// PR #4600 review CRITICAL #1: signing now happens here, not in the
+// Cloudflare worker. The worker never holds the private key — it just
+// transports the bytes + signature this script produces. That ties the
+// trust root to the registry repo's branch protection + Actions secret
+// scope, instead of the worker being a sign-anything oracle reachable
+// via REGISTRY_REFRESH_TOKEN.
+
+import fs from 'node:fs'
+import path from 'node:path'
+import crypto from 'node:crypto'
+
+const repoRoot = path.resolve(new URL('.', import.meta.url).pathname, '..')
+const indexPath = path.join(repoRoot, 'plugins-index.json')
+const sigPath = path.join(repoRoot, 'plugins-index.json.sig')
+
+const pkcs8B64 = (process.env.REGISTRY_PRIVATE_KEY || '').trim()
+if (!pkcs8B64) {
+  console.error(
+    'REGISTRY_PRIVATE_KEY is not set — refusing to ship unsigned index. ' +
+    'Add the PKCS#8-base64 Ed25519 private key as a GitHub Actions secret ' +
+    'on this repo (gh secret set REGISTRY_PRIVATE_KEY).',
+  )
+  process.exit(1)
+}
+if (!fs.existsSync(indexPath)) {
+  console.error(
+    `plugins-index.json missing at ${indexPath} — run scripts/build-plugins-index.mjs first.`,
+  )
+  process.exit(1)
+}
+
+const pkcs8Der = Buffer.from(pkcs8B64.replace(/\s+/g, ''), 'base64')
+let key
+try {
+  key = crypto.createPrivateKey({ key: pkcs8Der, format: 'der', type: 'pkcs8' })
+} catch (e) {
+  console.error(`REGISTRY_PRIVATE_KEY is not a valid PKCS#8-DER Ed25519 key: ${e.message}`)
+  process.exit(1)
+}
+if (key.asymmetricKeyType !== 'ed25519') {
+  console.error(
+    `REGISTRY_PRIVATE_KEY is a ${key.asymmetricKeyType} key — must be ed25519`,
+  )
+  process.exit(1)
+}
+
+const indexBytes = fs.readFileSync(indexPath)
+const sigBytes = crypto.sign(null, indexBytes, key)
+const sigB64 = sigBytes.toString('base64')
+
+const prev = fs.existsSync(sigPath) ? fs.readFileSync(sigPath, 'utf8').trim() : null
+if (prev === sigB64) {
+  console.log(`plugins-index.json.sig unchanged (${sigBytes.length} bytes)`)
+  process.exit(0)
+}
+fs.writeFileSync(sigPath, sigB64 + '\n')
+console.log(
+  `plugins-index.json.sig written: ${sigBytes.length} bytes signature ` +
+  `over ${indexBytes.length} bytes of index`,
+)