Sign the served config files (#76)

* feat(config): sign the served config files

signed/targets.json gives the sha256 of every JSON file the wallet may
fetch, signed with an Ed25519 targets key. signed/root.json names that
key and three sr25519 root keys (wallet accounts), two of which can
replace it; the wallet will ship this first root.

scripts/signed_config.py writes the root, signs the targets list and
checks it. Code Quality now refuses a tree whose served files do not
match the signed list, and runs weekly so an expiring signature shows a
month ahead.

* fix(config): sign the test fixtures and follow published roots

The wallet refuses any JSON file from this repository that the signed
list does not give, and its instrumented tests read tests/, so those
files are signed too.

A root after the first is written to signed/root.N.json, where the
wallet looks for it; sign and check use the newest published root.

.github/workflows/code-quality.yml

@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  # Weekly, so a signature running out shows here a month before the wallet stops trusting it.
+  schedule:
+    - cron: '0 7 * * 1'
 
 
 # Read-only token: Code Quality never writes through GITHUB_TOKEN.
@@ -64,6 +67,27 @@ jobs:
 
           exit $ERRORS
 
+  signed-config:
+    name: Signed Config
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install cryptography
+        run: pip install cryptography
+
+      # The wallet refuses a config file whose sha256 signed/targets.json does not give, so
+      # a change that was not re-signed must not reach master.
+      - name: Targets signed and matching every served file
+        run: python3 scripts/signed_config.py check
+
   chain-integrity:
     name: Chain Config Integrity
     runs-on: ubuntu-latest