build: signed PGXN release tooling + Drone pipeline

Build the distribution from src/ (control, versioned SQL, META, MIT LICENSE,
PGXS Makefile, install README), checksum it, and sign an Ed25519 JWT manifest
(audience pgmorbac-release) with the verification public key attached to the
release. `npm run release` does it locally; the Drone pipeline does it on a
v* tag once the repo is Trusted with the pgmorbac_release_key + gitea_token
secrets.

.drone.yml

@@ -0,0 +1,34 @@
+---
+kind: pipeline
+type: docker
+name: release
+
+# Cuts the signed PGXN distribution and publishes it as a Gitea release.
+# Triggered by version tags (v<major>.<minor>.<patch>).
+#
+# Repo must be Trusted in Drone. Required secrets:
+#   pgmorbac_release_key  Ed25519 private key PEM (content, not a path)
+#   gitea_token           Gitea API token with write access to crudy/pgmorbac
+
+trigger:
+  event:
+    - tag
+  ref:
+    - refs/tags/v*
+
+steps:
+  - name: build-and-release
+    image: node:24-alpine
+    environment:
+      PGMORBAC_RELEASE_KEY_PEM:
+        from_secret: pgmorbac_release_key
+      GITEA_TOKEN:
+        from_secret: gitea_token
+      GITEA_URL: https://git.villains.fr
+      GITEA_REPO: crudy/pgmorbac
+    commands:
+      - apk add --no-cache zip bash
+      - npm install --no-audit --no-fund
+      - umask 077 && printf '%s\n' "$PGMORBAC_RELEASE_KEY_PEM" > /tmp/release-key.pem
+      - PGMORBAC_RELEASE_KEY=/tmp/release-key.pem node scripts/build-dist.mjs
+      - node scripts/gitea-release.mjs