fix: unify GoodBuddy release signing identity

Use one generic GoodBuddy Ed25519 identity for the Agent bundle, bundled Runtime, outer package, and signed catalog while preserving each layer's existing signature domain.

Rename the production Environment contract to GOODBUDDY_SIGNING_*, register the matching production public key, and keep desktop and branch CI workflows isolated from the private key.

tests/agent-bundle.test.ts

@@ -512,7 +512,7 @@ describe('Agent production input handling', () => {
   it('requires CI-only production key variables and redacts them', () => {
     expect(() =>
       agentBundle.productionSigningKey({})
-    ).toThrow('required for production Agent signing')
+    ).toThrow('required for production GoodBuddy signing')
 
     const secret = [
       '-----BEGIN PRIVATE KEY-----',
@@ -521,8 +521,8 @@ describe('Agent production input handling', () => {
     ].join('\n')
     const error = `signing_key=${secret} key id prod-secret-id`
     const redacted = agentBundle.redactSecrets(error, {
-      GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY: secret,
-      GOODBUDDY_AGENT_SIGNING_KEY_ID: 'prod-secret-id'
+      GOODBUDDY_SIGNING_PRIVATE_KEY: secret,
+      GOODBUDDY_SIGNING_KEY_ID: 'prod-secret-id'
     })
     expect(redacted).not.toContain('fixture-secret-material')
     expect(redacted).not.toContain('prod-secret-id')
@@ -536,7 +536,7 @@ describe('Agent production input handling', () => {
         registry
       })
     ).toThrow(
-      'Production Agent public signing key ID "production-release-key" is absent from resources/agent-release-keys.json'
+      'Production GoodBuddy public signing key ID "production-release-key" is absent from resources/agent-release-keys.json'
     )
   })
 

tests/agent-release-workflow.test.ts

@@ -97,7 +97,7 @@ describe('independent Agent release workflow', () => {
     )
     expect(buildScripts).toContain('--ignore-scripts')
     expect(build).toContain(
-      'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
+      'GOODBUDDY_SIGNING_PRIVATE_KEY'
     )
     expect(workflow).not.toContain(
       'GOODBUDDY_REMOTE_RUNTIME_SIGNING_'
@@ -169,7 +169,7 @@ describe('independent Agent release workflow', () => {
   it('keeps private keys out of authorization and public publication jobs', () => {
     expect(serializedJob('authorize')).not.toContain('secrets.')
     expect(serializedJob('publish')).not.toContain(
-      'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
+      'GOODBUDDY_SIGNING_PRIVATE_KEY'
     )
   })
 })

tests/agents-workflow.test.ts

@@ -162,7 +162,7 @@ describe('GoodBuddy Agents workflow', () => {
     )
     expect(workflow).not.toContain('secrets.')
     expect(workflow).not.toContain(
-      'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
+      'GOODBUDDY_SIGNING_PRIVATE_KEY'
     )
     expect(ciBundleSource).toContain(
       "generateKeyPairSync('ed25519')"

tests/packages-workflow.test.ts

@@ -76,7 +76,7 @@ describe('desktop packages workflow', () => {
     expect(workflow).not.toContain('agent-signing:')
     expect(workflow).not.toContain('remote-runtime-signing:')
     expect(workflow).not.toContain(
-      'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
+      'GOODBUDDY_SIGNING_PRIVATE_KEY'
     )
   })
 

tests/remote-runtime-bundle.test.ts

@@ -315,7 +315,7 @@ describe('Remote Runtime bundle tooling', () => {
       runtimeBundle.preflightProductionSigningKey({
         projectRoot: process.cwd(),
         environment: {
-          GOODBUDDY_AGENT_SIGNING_KEY_ID:
+          GOODBUDDY_SIGNING_KEY_ID:
             'runtime-fixture'
         },
         registry: productionRegistry
@@ -326,7 +326,7 @@ describe('Remote Runtime bundle tooling', () => {
     })
   })
 
-  it('signs the bundled Runtime with the shared Agent identity', () => {
+  it('signs the bundled Runtime with the shared GoodBuddy identity', () => {
     const productionRegistry: AgentReleaseKeyRegistry = {
       ...registry,
       keys: registry.keys.map((key) => ({