feat: GitHub Pages apt repo with per-major-version dist tracks (#230)

Implements ADR-010: stable releases are now published to
https://thegrandwazoo.github.io/freenas-proxmox/ in addition to Cloudsmith.

Dist tracks:
  v3 main  — v3.x releases (new installs)
  main main — v2.x only (backward-compat, never auto-promoted to v3)
  v2 main  — v2.x alias (explicit pin)

CI: new "Publish to GitHub Pages APT repo" step in the publish job runs on
tagged stable releases. Downloads the built .deb, places it in pool/v{major},
regenerates Packages.gz and a GPG-signed InRelease for the relevant dist(s),
and pushes to the gh-pages branch.

Setup: scripts/setup-apt-signing-key.sh generates the GPG key pair and prints
the exact `gh secret set` commands to run. Requires APT_SIGNING_KEY and
APT_SIGNING_KEY_PASSPHRASE secrets to be added to the repo before the first
tagged release.

README updated to point new installs at GitHub Pages; Cloudsmith testing
channel retained for beta builds.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/setup-apt-signing-key.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# One-time setup: generate the GPG key used to sign the GitHub Pages apt repo.
+#
+# Run this locally once. After running:
+#   1. Commit public.gpg.key to the gh-pages branch (instructions printed below)
+#   2. Add APT_SIGNING_KEY to GitHub Actions secrets
+#   3. Add APT_SIGNING_KEY_PASSPHRASE to GitHub Actions secrets (empty string if no passphrase)
+#
+# Re-running is safe — it checks for an existing key first.
+set -euo pipefail
+
+REPO="TheGrandWazoo/freenas-proxmox"
+KEY_NAME="truenas-proxmox"
+KEY_EMAIL="packages@ksatechnologies.com"
+KEY_COMMENT="truenas-proxmox apt repo signing key"
+
+# ── Check for existing key ────────────────────────────────────────────────────
+EXISTING="$(gpg --list-secret-keys --with-colons 2>/dev/null \
+  | awk -F: -v name="$KEY_NAME" '$1=="uid" && $10 ~ name {found=1} END {print found+0}')"
+
+if [[ "$EXISTING" == "1" ]]; then
+  echo "Key '$KEY_NAME' already exists in your keyring — skipping generation."
+  KEY_ID="$(gpg --list-secret-keys --with-colons 2>/dev/null \
+    | awk -F: '/^sec/{print $5; exit}')"
+else
+  # ── Generate key ─────────────────────────────────────────────────────────────
+  echo "Generating GPG key for apt repo signing..."
+  read -r -s -p "Enter a passphrase (leave empty for no passphrase): " PASSPHRASE
+  echo
+
+  gpg --batch --gen-key <<EOF
+%echo Generating truenas-proxmox apt signing key
+Key-Type: RSA
+Key-Length: 4096
+Subkey-Type: RSA
+Subkey-Length: 4096
+Name-Real: ${KEY_NAME}
+Name-Comment: ${KEY_COMMENT}
+Name-Email: ${KEY_EMAIL}
+Expire-Date: 0
+$([ -n "$PASSPHRASE" ] && echo "Passphrase: ${PASSPHRASE}" || echo "%no-protection")
+%commit
+%echo Done
+EOF
+
+  KEY_ID="$(gpg --list-secret-keys --with-colons 2>/dev/null \
+    | awk -F: '/^sec/{print $5; exit}')"
+  echo "Generated key: $KEY_ID"
+fi
+
+# ── Export public key ─────────────────────────────────────────────────────────
+echo
+echo "==> Exporting public key..."
+gpg --export --armor "$KEY_ID" > /tmp/truenas-proxmox-public.gpg.key
+echo "Public key written to /tmp/truenas-proxmox-public.gpg.key"
+
+# ── Export private key (base64) ───────────────────────────────────────────────
+echo
+echo "==> Exporting private key (base64) for GitHub Actions secret..."
+PRIVATE_KEY_B64="$(gpg --export-secret-keys --armor "$KEY_ID" | base64 -w 0)"
+
+# ── Instructions ─────────────────────────────────────────────────────────────
+cat <<INSTRUCTIONS
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+NEXT STEPS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+1. Add APT_SIGNING_KEY to GitHub Actions secrets:
+   gh secret set APT_SIGNING_KEY --repo ${REPO} --body "${PRIVATE_KEY_B64}"
+
+2. Add APT_SIGNING_KEY_PASSPHRASE to GitHub Actions secrets:
+   gh secret set APT_SIGNING_KEY_PASSPHRASE --repo ${REPO} --body "YOUR_PASSPHRASE"
+   (use empty string if you chose no passphrase:)
+   gh secret set APT_SIGNING_KEY_PASSPHRASE --repo ${REPO} --body ""
+
+3. Commit public.gpg.key to the gh-pages branch:
+   git checkout gh-pages
+   cp /tmp/truenas-proxmox-public.gpg.key public.gpg.key
+   git add public.gpg.key
+   git commit -m "chore: add apt repo GPG public key"
+   git push origin gh-pages
+   git checkout release/3.x
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+INSTRUCTIONS