installer: production release-signing key

The embedded pubkey is the production key from the signing ceremony;
release.sh's key-match gate now refuses any other signer. Verified:
production-signed archives pass fwup 1.16 and the factory's 0.14.2;
dev-signed archives are rejected.

docs/BRINGUP.md

@@ -119,8 +119,12 @@ motion constants were extracted from the `_RESOURCES` pulse files
   what fwup 0.14.2 expects; 1.x reads both). Cross-version compat is
   proven both ways (modern-packed signed archives apply with 0.14.2;
   modern fwup verifies+applies the factory .fw — signer key
-  2017-05-001.pub). The production release key does not exist yet —
-  generation/custody is an operator ceremony (UPDATE-SYSTEM.md gate 8).
+  2017-05-001.pub). The production signing-key ceremony
+  (UPDATE-SYSTEM.md gate 8) was executed 2026-08-08.
+  **The production release key lives at
+  `~/forgefirm-release-key/fwup-key.priv`** (0600; `fwup-key.pub` +
+  `fwup-key-raw.pub` beside it; offline backups held by the operator) —
+  the installer embeds its pubkey, so releases sign with THIS key only.
   Pack releases with `scripts/mkfw.sh`; the full pipeline is
   `scripts/release.sh`, invoked on this host as:
   `FWUP=~/fwup-lab/bin/fwup-v1.16.0 FWUP_COMPAT=~/fwup-lab/bin/fwup-0.14.2

docs/UPDATE-SYSTEM.md

@@ -234,17 +234,16 @@ selector, factory restore and return — without touching a shell.*
    ≥ 195 MiB.
 4. **RESOLVED** (Phase 3): dev archives are always signed with the
    dedicated dev key (`release.sh --dev`), never unsigned.
-8. Production signing-key ceremony — **procedure defined, execution
-   pending**: generate with fwup on the build host (never in the
-   repo, CI, or cloud-synced plaintext; the build-host copy is the
-   only online copy), keep ≥ 2 verified offline backups (USB /
-   paper — the private key is 128 hex chars — / passphrase-encrypted
-   file), embed the public key in the installer (release.sh's
-   key-match gate enforces the swap), and verify a signed test
-   archive with both fwup generations before first use. Custody
-   optimizes against compromise over loss: loss means users re-run a
-   fresh installer; compromise means attacker-signed firmware on
-   fielded machines.
+8. **RESOLVED** — production signing-key ceremony executed: key
+   generated on the build host (never in the repo, CI, or
+   cloud-synced plaintext; the build-host copy is the only online
+   copy, offline backups held by the operator), public key embedded
+   in the installer, and the chain verified: production-signed
+   archives verify with fwup 1.16 and the factory's 0.14.2 (raw
+   pubkey form); dev-signed archives are rejected. Custody optimizes
+   against compromise over loss: loss means users re-run a fresh
+   installer; compromise means attacker-signed firmware on fielded
+   machines.
 5. Periodic GUI update check default-on vs opt-in (it pings the GitHub
    API; proposal: on by default, apply always manual, config switch to
    disable).