Merge nucleic/olive-ember-seal-q7vk into dev

packages/naros-keyring/stage.sh

@@ -0,0 +1,10 @@
+# The public key is materialized by CI from the NAROS_APT_PUBLIC_KEY secret (or by an
+# operator into os/repo/keys/). No key in the tree, no keyring package — skip cleanly.
+stage() {
+  local dest="$1" key="$OS_DIR/repo/keys/naros-archive-keyring.gpg"
+  if [ ! -f "$key" ]; then
+    echo "public key missing: $key (CI materializes it from secrets)" > "$dest/.skip-reason"
+    return 1
+  fi
+  install -D -m 0644 "$key" "$dest/usr/share/keyrings/naros-archive-keyring.gpg"
+}