enforce signed tags in release gate; add allowed signers

.gitea/allowed_signers

@@ -0,0 +1 @@
+casey.tunturi@gmail.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJb7XowYoupqZoRTf0U4RKJcBH6DR+nKOocmoPRFaWf6

.gitea/workflows/release.yml

@@ -90,6 +90,23 @@ jobs:
             FAIL=1
           fi
 
+          # Tag must be signed with an SSH key from the allowed signers file.
+          # This ensures the release was created by an authorized maintainer.
+          SIGNERS_FILE=".gitea/allowed_signers"
+          if [ ! -f "$SIGNERS_FILE" ]; then
+            echo "::error::allowed signers file not found at $SIGNERS_FILE"
+            FAIL=1
+          else
+            git config gpg.format ssh
+            git config gpg.ssh.allowedSignersFile "$SIGNERS_FILE"
+            if ! git tag -v "v$TAG" >/dev/null 2>&1; then
+              echo "::error::tag v$TAG is not signed or signature is invalid"
+              FAIL=1
+            else
+              echo "Tag signature verified"
+            fi
+          fi
+
           exit $FAIL
 
       - name: Component catalog gate