Use sq Bazel module for PGP signing

[Copilot]

//pgp no longer needs to fetch unverified per-platform sq release binaries through a custom module extension. The default signer now comes from the Envoy Bazel registry as sq@1.4.0.envoy.

• Registry and module dependency

  • Bumped the Envoy Bazel registry pin to 9dbaa5076459279d6c86b400a7ab5a9b898cf08c.
  • Added the registry-backed dependency:

    bazel_dep(name = "sq", version = "1.4.0.envoy")

• Default PGP toolchain

  • Added //pgp:sq_toolchain, wrapping @sq//:sq.
  • Registered it for non-dev consumers.
  • Kept the dev-only stub toolchain registered first so //pgp/test analysis tests continue to resolve the stub signer.

• sq_signer executable handling

  • Changed sq_signer.sq from a single-file input to an exec-config executable.
  • Uses ctx.executable.sq / DefaultInfo.files_to_run.
  • Merges sq runfiles into the signer wrapper runfiles.

• Removed obsolete download extension

  • Deleted //pgp:extensions.bzl.
  • Removed extension exports, bzl_library references, and commented MODULE examples.

• Documentation

  • Updated //pgp docs to describe the default @sq//:sq signer and the remaining custom signer toolchain swap path.

[netlify]

✅ Deploy Preview for nifty-bassi-e26446 ready!

Name	Link
🔨 Latest commit	087fad7
🔍 Latest deploy log	https://app.netlify.com/projects/nifty-bassi-e26446/deploys/6a9e4e5702dad000082fe393
😎 Deploy Preview	https://deploy-preview-5195--nifty-bassi-e26446.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.