pgp: convert signing key to host path build setting

[Copilot]

Converts the OpenPGP signing key in bazel/pgp/ from a Bazel label artifact (key = attr.label(...)) to a host path build setting (//pgp:key_path), aligning it with passphrase_path. This prevents secret key material from entering the Bazel build graph, being hashed in action keys, or being uploaded to remote caches.

Key Changes

• Build Settings & Starlark Rules (bazel/pgp/)

  • Added //pgp:key_path string_flag.
  • Added _host_path helper in pgp/private/sign.bzl to parse absolute host paths and optional #sha256= digest fragments for key_path (failing if a fragment is given on passphrase_path to avoid passphrase offline-cracking oracles).
  • Removed key attribute from pgp_sign and public macros (pgp_sign_detached, pgp_sign_cleartext, pgp_sign_checksums, pgp_sign_changes_file), setting OpenPGPSign action inputs to [src] only.

• Signer CLI Contract (signer.sh, stub_signer.sh, toolchain.bzl)

  • Added --key-sha256 parameter to signer.sh to verify key digest against host key file prior to key encryption checks and passphrase handling.
  • Enforced that --key must be an absolute host path.

• Audit Hardening (audit_test.sh, audit_fixtures_test.sh, live_audit.sh)

  • Extended FORBIDDEN_INPUTS regex to match key-like file artifacts (.asc, .pgp, .gpg, .key, secret).
  • Added Check 5 enforcing that every OpenPGPSign action has strictly one non-tool input artifact (the file being signed).
  • Updated audit script target flags and regenerated fixtures/audit.json.

• Tests & Documentation (sign_test.bzl, signer_test.sh, README.md)

  • Removed example_key.pgp fixture target and key attributes across pgp/test/BUILD.
  • Added analysis and integration tests for --key-sha256 presence/absence, non-tool inputs set validation, empty key path, relative paths, and digest fragment rules.
  • Updated README.md security model, "What you still own", rules table, and usage guidance.

Usage Example

# Previously: pgp_sign_detached(name = "signed_tarball", src = ":tarball", key = ":signing-key.asc")
pgp_sign_detached(
    name = "signed_tarball",
    src = ":tarball",
)

bazel build //:signed_tarball \
    --@envoy_toolshed//pgp:key_path=/run/user/1000/gpg/signing-key.asc#sha256=<hex> \
    --@envoy_toolshed//pgp:passphrase_path=/run/user/1000/gpg/passphrase