The signed distribution is published as a GitHub release by the release
workflow on v* tags, replacing the Gitea release and its Drone pipeline.
The release body and the dist README take the homepage from META.json.
Build the distribution from src/ (control, versioned SQL, META, MIT LICENSE,
PGXS Makefile, install README), checksum it, and sign an Ed25519 JWT manifest
(audience pgmorbac-release) with the verification public key attached to the
release. `npm run release` does it locally; the Drone pipeline does it on a
v* tag once the repo is Trusted with the pgmorbac_release_key + gitea_token
secrets.
marc