add PoC for signed charts

[David-Development]

Sign chart packages (provenance files)

Releases now ship an OpenPGP-signed .tgz.prov next to every chart package, so
helm verify works and Artifact Hub shows the "signed" badge (it probes
<chart-url>.prov for HTTP repos and the provenance layer for OCI ones).

Changes

• helm-release.yml — restores the signing keyring from GPG_KEYRING_BASE64,
  packages with --sign, verifies the result against the committed public key,
  and attaches the .prov to the GitHub release. helm push picks it up as an
  OCI provenance layer automatically. The artifacthub.io/signKey annotation is
  injected at package time from the key actually used, so it cannot drift.
• helm-pages.yml — collects *.tgz.prov alongside the packages, verifies every
  signed package before deploying, and publishes signing-key.asc next to
  index.yaml.
• Chart.yaml — artifacthub.io/category was a top-level key, which Helm silently
  drops; moved under annotations: so it reaches Artifact Hub.
• Verification instructions on the Pages landing page, in the release notes, and in
  DISTRIBUTION.md (key generation, secrets, rotation).

Required before the next tag

A tagged release now fails if signing material is missing (pushes to main only
warn):

1. Commit the armored public key to .github/pages/signing-key.asc.
2. Add the GPG_KEYRING_BASE64 and GPG_PASSPHRASE secrets — see
   DISTRIBUTION.md → "Chart signing".

Charts released before this change stay unsigned and are skipped during verification.
.gitlab-ci.yml is unchanged; the GitLab pipeline is a mirror and is not indexed by
Artifact Hub.

[David-Development]

@seb-kw @timbastin Das hier wird benötigt falls wir bei Artifactshub die Signierungs-Badge bekommen wollen. Erstmal nur ein PoC (durch Claude). Ob wir wirklich alles brauchen sei dahingestellt. Lässt sich auch sicher deutlich reduzieren (nur signierung ohne validierung etc. etc.)

https://artifacthub.io/packages/helm/devguard/devguard