fix(ci): add gpg and rpmsign diagnostics to isolate signing failure

Test gpg signing directly, dump macro expansion, and use rpmsign
with --verbose to get more detail.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

script/publish-repo.sh

@@ -12,11 +12,18 @@ cat ~/.rpmmacros
 echo "gpg keys:"
 gpg --list-secret-keys --keyid-format long
 ls -la "${RPM_DIR}"/*.rpm
+
+echo "testing gpg signing directly..."
+echo test | gpg --batch --pinentry-mode loopback --passphrase '' --sign --armor -u "$(rpm --eval '%{_gpg_name}')" 2>&1 || echo "direct gpg sign failed"
+
+echo "rpm macro expansion:"
+rpm --eval '%{__gpg}' 2>&1
+rpm --eval '%{_gpg_name}' 2>&1
+
 for rpm in "${RPM_DIR}"/*.rpm; do
     echo "signing ${rpm}..."
-    rpm --addsign "${rpm}" 2>&1 | tee /tmp/rpmsign.log || {
+    rpmsign --addsign "${rpm}" --verbose 2>&1 || {
-        echo "failed to sign ${rpm}:" >&2
+        echo "failed to sign ${rpm}" >&2
-        cat /tmp/rpmsign.log >&2
         exit 1
     }
 done