bazel/pgp: fix review findings (sandboxing, passphrase handling, audit, single-src signing)

[Copilot]

Review of the hermetic OpenPGP signing rules in bazel/pgp/ surfaced several gaps between the stated security model and the implementation: signing actions ran unsandboxed, the passphrase was copied to a second plaintext file, the audit script's "suspicious input" check was dead code against real aquery output, and several rules/tests relied on genrules or a multi-file srcs contract that didn't match actual usage.

Sandboxing & secrets

• Removed local (no-sandbox) from EXECUTION_REQUIREMENTS in sign.bzl, sign_test.bzl, audit_test.sh, and fixtures — signing actions now stay sandboxed as well as local/uncached.
• signer.sh no longer copies the passphrase to a mktemp file; it now passes it to sq --password-file via process substitution (<(printf %s "$(cat "$PASSPHRASE_FILE")")), so it's never written to disk a second time. Removed the now-unneeded trap/umask scaffolding.
• Signing/checksums actions now set an explicit, minimal env = {"PATH": "/usr/bin:/bin"} instead of relying on env = {} and libc's compiled-in default path.

Audit script

• Check build(deps): bump actions/upload-artifact from 2 to 3 #2 (suspicious key-material inputs) previously read a nonexistent .artifacts[].execPath field, only "passing" because a fixture hand-inserted it. Rewrote it in jq to reconstruct real paths from pathFragments/parentId, scoped to inputs reachable from OpenPGPSign actions via inputDepSetIds/depSetOfFiles.
• Added //pgp/test:live_audit (bazel run //pgp/test:live_audit), which re-runs the audit against a real bazel aquery of the example targets instead of captured JSON, wired into CI as a new matrix entry.
• Cut the 5 committed ~1000-line JSON fixtures down to one real fixtures/audit.json; the 4 broken variants (dropped execution requirement, leaked HOME, key-material input, passphrase on argv) are now derived from it with jq at test time.

Rule/test cleanup

• pgp_sign takes a single src = attr.label(allow_single_file = True, mandatory = True) instead of srcs + a runtime "exactly one" check.
• Replaced the example_key/example_data/example_changes genrules with static fixture files, and the extensions_load_check genrule/.bzl with a bzl_library covering the public/private starlark surface.
• Renamed deb_sign_changes → pgp_sign_changes_file with a doc/TODO clarifying it only clearsigns the .changes/.dsc itself, not a full debsign (referenced .dsc/.buildinfo re-signing is not implemented).

MODULE.bazel.lock was left untouched — this working copy doesn't have the pre-PR parent commit to diff against, and no unrelated churn was introduced here.