security: support update-signing key rotation

[nextestudios]

Summary

Accept a set of trusted update keys so the signing key can be rotated without breaking automatic updates.

Motivation

The private key exists only in a GitHub secret; losing or leaking it would otherwise require manual reinstalls.

Requirements

• Multiple public keys in UpdateTrust; documented rotation procedure.

Controller UX

N/A.

Technical Notes

ControlFS.Infrastructure.Updates.

Acceptance Criteria

• A manifest signed by either trusted key is accepted; others are refused.

Testing

Unit tests for new branches and for every bug reproduced before a fix (no trivial variations, see AGENTS.md).

Dependencies

• None

---

Priority: low · Milestone: 9 · 1.0 Readiness