feat: sign repo DB with dedicated ed25519 signing key

Replace the maintainer key in antergos-next-keyring with the new
Antergos NeXT Package Signing key (AA644A09..., sign subkey
3F1B219A..., expires 2028-08-16). CI now signs the repo database
with it (--detach-sign, loopback pinentry from SIGNING_KEY /
SIGNING_PASSPHRASE secrets). Client SigLevel switches from
'Optional TrustAll' to 'DatabaseRequired PackageOptional' — the
signed DB authenticates every package via its checksums.

setup-repo.sh

@@ -14,7 +14,7 @@ if ! grep -q "\[antergos-pkgs\]" /etc/pacman.conf; then
     cat >> /etc/pacman.conf << 'CONF'
 
 [antergos-pkgs]
-SigLevel = Optional TrustAll
+SigLevel = DatabaseRequired PackageOptional
 Server = https://antergos-next.github.io/antergos-packages/
 CONF
     echo "Added antergos-pkgs to pacman.conf"
@@ -22,6 +22,9 @@ else
     echo "antergos-pkgs already in pacman.conf"
 fi
 
+pacman-key --init 2>/dev/null || true
+pacman-key --populate antergos-next 2>/dev/null || true
+
 pacman -Sy
 
 echo "Antergos NeXT PKGS ready!"