Publish root 2: root keys move to three dedicated holders (#84)

signed/root.2.json carries the root drafted in docs/root-signing/proposals (threshold 2 of
3 new sr25519 holders, five years, targets key unchanged) with two signatures from the
previous root's keys and two from the new ones, all valid under the "substrate" context
that installed wallets check. Wallets already follow signed/root.N.json, so they move to
the new root on their next config refresh.

The consumed proposal is removed; the CI check runs with no proposals present.

.github/workflows/code-quality.yml

@@ -103,6 +103,7 @@ jobs:
       - name: Root chain verifies as installed wallets check it
         run: |
           npm ci --prefix scripts/root --ignore-scripts --no-audit --no-fund
+          shopt -s nullglob
           node scripts/root/verify_root.mjs docs/root-signing/proposals/*.json
 
   chain-integrity: