Document Gitea Arch DB-signing key import for [tanin]

The Gitea Arch registry signs the repo DB with its own key
(63F0415879323F6BFE0FBFB2B6FDF356206AF4F6); import it via
.../arch/repository.key + pacman-key --lsign-key before -Sy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

distro/camel.toml

@@ -45,7 +45,8 @@ repo_name = "tanin"
 status    = "LIVE — hosted on the Gitea Arch registry, 9 packages, public, pacman-usable"
 server    = "https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch"
 code_host = "https://git.openbureau.ch/karim/taninux"   # PKGBUILD source clones
-siglevel  = "Optional TrustAll"     # TODO: tighten to "Required" + ship the key
+siglevel  = "Optional TrustAll"     # works once Gitea's DB-signing key is imported
+db_key    = "Gitea signs the repo DB with 63F0415879323F6BFE0FBFB2B6FDF356206AF4F6; import via .../arch/repository.key + pacman-key --lsign-key. ISO/Calamares must import it too."
 publish   = "packaging/publish-tanin-repo.sh (needs a write:package token); Gitea builds the DB server-side"
 vanity    = "taninux.kgva.ch can reverse-proxy / front this later"
 

distro/tanin.pacman.conf

@@ -1,6 +1,18 @@
 # [tanin] — TANINUX (camel) binary repo, hosted on the Gitea Arch registry.
-# Append this block to /etc/pacman.conf, then:  sudo pacman -Sy
+#
+# The Gitea Arch registry SIGNS the repo DB with its own key, so that key must
+# be imported + locally signed first (one time), then add the repo block below.
+#
+#   curl -s https://git.openbureau.ch/api/packages/karim/arch/repository.key \
+#     | sudo pacman-key --add -
+#   sudo pacman-key --lsign-key 63F0415879323F6BFE0FBFB2B6FDF356206AF4F6
+#
+# Then append this to /etc/pacman.conf and:  sudo pacman -Sy
 #   sudo pacman -S tanin-desktop      # pulls the whole niri/eww desktop
+#
+# (Quick alternative without importing the key: set `SigLevel = Never` below —
+#  less secure, skips all signature checks. The ISO/Calamares should import the
+#  key into the live + target keyring instead.)
 [tanin]
 SigLevel = Optional TrustAll
 Server = https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch