Update Helm chart paths in workflows and documentation to avoid ambiguity in Gitea's package registry

pubkeys/README.md

@@ -1,11 +1,13 @@
 # Public keys
 
-## Chart signing key (needed, not yet set up)
+## Chart signing key
 
 `.gitea/workflows/release-chart.yaml` runs `helm package --sign` to produce a
-`.tgz.prov` file for every chart release, and `charts/aptly/Chart.yaml` is meant to
-carry an `artifacthub.io/signKey` annotation pointing at the public half of that
-key (both are currently commented out / referencing a placeholder — see below).
+`.tgz.prov` file for every chart release, and `charts/aptly/Chart.yaml` carries an
+`artifacthub.io/signKey` annotation pointing at `chart-signing.asc` in this
+directory (fingerprint `FC35C0FAA26605C4C21C7BBFBF43884145E5AA94`). The matching
+private key is stored as the `GPG_PRIVATE_KEY`/`GPG_PASSPHRASE`/`GPG_KEY_ID`
+secrets in this repo's Gitea settings.
 
 **This key must NOT be Ed25519/EdDSA.** Helm's chart signing is built on the
 deprecated `golang.org/x/crypto/openpgp` library, which cannot read Ed25519 keys at
@@ -25,7 +27,7 @@ Ed25519 — see [docs/packaging.md](../docs/packaging.md#gpg) — just not for
 `helm package --sign`. This repo therefore needs its own, separate, RSA key
 dedicated to chart-package signing.
 
-### Generating it
+### Generating a replacement (e.g. on rotation)
 
 Run this yourself (locally, not in CI) so the private key material never has to
 pass through anything but your own machine and the Gitea secrets store:
@@ -44,16 +46,15 @@ gpg --armor --export <key-id> > pubkeys/chart-signing.asc
 gpg --armor --export-secret-keys <key-id>                              # -> paste as GPG_PRIVATE_KEY
 ```
 
-Then, in the repo's Gitea settings:
+Then, in the repo's Gitea settings, update:
 - Secret **`GPG_PRIVATE_KEY`** — the armored output of the last command above
 - Secret **`GPG_PASSPHRASE`** — whatever passphrase you set (empty string if none)
 - Secret **`GPG_KEY_ID`** — the key ID or fingerprint from `gpg --list-secret-keys`
 
-Commit `pubkeys/chart-signing.asc`, then uncomment the `artifacthub.io/signKey`
-block in `charts/aptly/Chart.yaml` with the real fingerprint, and uncomment
-`pubkeys/chart-signing.asc` in `release-chart.yaml`'s release-assets step.
+Commit the new `pubkeys/chart-signing.asc` over the old one, and update the
+fingerprint in the `artifacthub.io/signKey` annotation in `charts/aptly/Chart.yaml`.
 
-### Verifying a downloaded chart (once the key exists)
+### Verifying a downloaded chart
 
 ```bash
 gpg --import pubkeys/chart-signing.asc