refactor!: remove GPG commit verification, SSH-only signing

[chiro-hiro]

Summary

Commit signature verification is now SSH-only. All GPG verification code and trust anchors are removed:

• Deleted: check-gpg.sh, security.sh (GPG allowlist rebuilder), gpg-list.asc, and the entire gpg/ key directory (13 keys).
• generate-checksums.sh: dropped check-gpg.sh / gpg-list.asc from the covered-file list; checksum.sha256 regenerated (9 covered files, down from 12) — checksum changes included in this PR.
• generate-ssh-allowed-signers.sh: removed the GPG-vs-SSH trust-anchor drift report (it iterated the now-deleted gpg/*.asc); refreshed ssh-allowed-signers roster included.
• CODEOWNERS / .gitignore: removed entries for the deleted files and their runtime artifacts (.allowed-keyids.txt, gpg-list.asc.1).
• Docs: README.md and SECURITY.md now document only the check-ssh.sh flow; SSH-only signer onboarding in SECURITY.md; CHANGELOG updated.

Note: check-ssh.sh keeps git config gpg.format ssh / gpg.ssh.allowedSignersFile — those are Git's literal config key names for SSH signature verification.

Breaking change

Consumers piping check-gpg.sh to bash will 404 once this merges. orochi-network/actions must switch any composite action calling check-gpg.sh to check-ssh.sh (coordinated follow-up).

Verification

• bash -n and shellcheck pass on all modified scripts.
• ./generate-checksums.sh re-run; checksum.sha256 is fresh and sorted (CI checksum-freshness check should pass).
• grep -ri gpg over the repo: only intentional remains (Git config key names in check-ssh.sh, CHANGELOG history).

[on-unknown-fish]

Thanks for the cleanup — the GPG removal is thorough and internally consistent: checksum.sha256 verifies, CODEOWNERS/README/SECURITY/CHANGELOG all track the deletions, and a test-merge against current main is conflict-free with the generated ssh-allowed-signers matching GITHUB_USERS.

One thing I want to confirm before approving, because it's a security-boundary change that isn't called out:

This PR also shrinks the SSH trusted-signer roster, not just GPG. Beyond deleting the GPG anchor, it drops these principals from ssh-allowed-signers / GITHUB_USERS:

alothanhh, CaoHoaiTan, harris1111, hungnguyen18, ngotrongphuc, nguyendinhthang3101, SangTran-127, ThanhNguyen03, wonrax (plus BaoNinh2808/brianw3b, who had no SSH keys anyway).

Several of these users have live SSH keys in the current file (e.g. harris1111 has 6). Since signing is now SSH-only, once this merges their SSH-signed commits will start failing check-ssh.sh — they'd each need to be re-added and re-onboarded per SECURITY.md.

Two questions:

1. Is removing these contributors from the trust roster intentional here, or a byproduct of reverting the GPG-mirroring reconciliation? If they're still active committers, dropping them will break their CI.
2. If it is intentional, please add a line to the CHANGELOG ### Removed entry noting the signer-roster reduction — right now the entry only mentions GPG, so a reader wouldn't realize ~9 signers lose the ability to pass signature checks.

Happy to approve once this is either confirmed intentional + documented, or the roster is preserved. Not blocking on anything else.

[chiro-hiro]

Good catch — answering both points:

1. Intentional. The roster reduction is a deliberate maintainer decision made together with the move to SSH-only signing: the trust anchor is being reset to the currently active signers (brng1151, chiro-hiro, bao-ninh-orochi, chirojr) rather than carried over wholesale from the GPG-mirroring reconciliation. Removed contributors who resume committing get re-added through the SECURITY.md onboarding flow (reviewed, signed PR touching GITHUB_USERS + regenerated ssh-allowed-signers + checksum.sha256) — which is the boundary working as designed.

2. Documented. Pushed 3da7ed5: the CHANGELOG ### Removed section now has a dedicated "Trusted-signer roster reduction (security boundary)" entry listing all 11 removed usernames, noting that only nine had live SSH entries (BaoNinh2808/brianw3b published no keys), that their commits will no longer pass check-ssh.sh, and pointing at the SECURITY.md re-onboarding flow.

CHANGELOG.md isn't in the checksum.sha256 covered-file set, so no checksum change; CI is re-running on the new commit.

[on-unknown-fish]

Both points from my earlier review are resolved:

1. Roster reduction confirmed intentional — a deliberate maintainer decision to reset the trust anchor to the currently active signers, with re-onboarding via the SECURITY.md flow for anyone who resumes committing. That's the boundary working as designed.
2. Documented — 3da7ed5 adds the dedicated "Trusted-signer roster reduction (security boundary)" entry to the CHANGELOG ### Removed section, listing all 11 removed usernames, noting only nine had live SSH entries, and pointing at the re-onboarding flow.

GPG removal remains thorough and internally consistent (checksum fresh, CODEOWNERS/README/SECURITY tracked, generator drift-report cleanly removed). All four required checks pass. Approving and merging.