fix(ci): OTA 私钥改为写文件签名, 修正配置中心存储的坏密钥

- 配置中心原 MINISIGN_PRIVATE_KEY 缺首行 untrusted comment (只含 base64),
  minisign 报 'Error while loading the secret key file'
- 已删除坏条目 (cfg-mtwmbmkd-bbiihv), 保留正确完整值 (cfg-mtwr5c2m-99r5fh)
- docker-build.yml / ota-build.yml 不再用 GITHUB_ENV 多行 heredoc,
  改为把私钥写入 ota-package/hotswap.key, build-ota.mjs --key 显式指定
- 本地全链路验证: 配置中心拉取 → 写文件 → 签名 → 用 tauri.conf.json 公钥验签通过

.gitea/workflows/docker-build.yml

@@ -43,6 +43,8 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y minisign
 
       - name: Fetch config center (minisign key)
+        # 私钥直接写文件 (build-ota.mjs 默认 KEY_PATH 即 ota-package/hotswap.key),
+        # 绕开 GITHUB_ENV 多行值在 Gitea Actions 下不可靠的问题
         run: |
           set -euo pipefail
           export CONFIG_CENTER_URL="${CONFIG_CENTER_URL:-$REGISTRY_URL_FALLBACK}"
@@ -55,19 +57,15 @@ jobs:
               req.add_header("Authorization", "Bearer " + token)
           with urllib.request.urlopen(req, timeout=20) as r:
               data = json.load(r).get("data", [])
-          wanted = {}
-          for cfg in data:
-              if cfg.get("key") == "MINISIGN_PRIVATE_KEY":
-                  wanted[cfg["key"]] = cfg.get("value", "")
-          with open(os.environ["GITHUB_ENV"], "a", encoding="utf-8") as f:
-              for k, v in wanted.items():
-                  if "\n" in v or v.startswith("untrusted comment"):
-                      f.write(f"{k}<<EOF\n{v}\nEOF\n")
-                  else:
-                      f.write(f"{k}={v}\n")
-          if "MINISIGN_PRIVATE_KEY" not in wanted:
+          key_val = next((c.get("value", "") for c in data if c.get("key") == "MINISIGN_PRIVATE_KEY"), None)
+          if not key_val:
               raise SystemExit("配置中心缺少 MINISIGN_PRIVATE_KEY (service-wardrobe/ota)")
+          os.makedirs("ota-package", exist_ok=True)
+          with open("ota-package/hotswap.key", "w", encoding="utf-8") as f:
+              f.write(key_val if key_val.endswith("\n") else key_val + "\n")
+          os.chmod("ota-package/hotswap.key", 0o600)
           PYEOF
+          echo "hotswap.key lines=$(wc -l < ota-package/hotswap.key)"
 
       - name: Build & sign OTA package
         # 每次主分支提交生成 OTA 升级包, sequence 默认时间戳 (单调递增)
@@ -76,7 +74,8 @@ jobs:
           OTA_NOTES: ${{ github.sha }}
         run: |
           set -euo pipefail
-          node scripts/build-ota.mjs --out ota-package --notes ${OTA_NOTES}
+          # --key 显式指定 (默认路径相同); 私钥已由上一步写入该文件
+          node scripts/build-ota.mjs --out ota-package --key ota-package/hotswap.key --notes ${OTA_NOTES}
           echo "===== latest.json ====="
           cat ota-package/latest.json
           echo "===== bundle sha256 ====="