Replace the maintainer key in antergos-next-keyring with the new
Antergos NeXT Package Signing key (AA644A09..., sign subkey
3F1B219A..., expires 2028-08-16). CI now signs the repo database
with it (--detach-sign, loopback pinentry from SIGNING_KEY /
SIGNING_PASSPHRASE secrets). Client SigLevel switches from
'Optional TrustAll' to 'DatabaseRequired PackageOptional' — the
signed DB authenticates every package via its checksums.