forgeext: the recipe, and the extension-signing key in the keyring

forgeext is the extension host, a component of its own: recipe
recipes-forgefirm/forgeext (cmake, pkgconfig, forgefirm-manifest, so it is
a manifest component with its own pin file). It links jansson, libarchive,
and libsodium, and runs with fwup, the keyring, and forgefirm-sandbox.
libarchive and jansson are on the image already; libsodium comes with it.
The pin is all zeros because the repository has no pushed commit to name:
the recipe builds from a working tree through externalsrc, and a build
from pins cannot fetch it until the first push sets the pin. It is not in
the image's install list.

forgefirm-keys installs a third trust anchor,
/etc/forgefirm/keys/ext/forgefirm-ext.pub: the OpenGlow extension-signing
public key, the official tier of extension packages. It is a different key
from the release key on purpose: it signs more often, and its loss must
not sign firmware. forgeext refuses an extension archive whose only valid
signature is the release key's or a factory key's.

Proven. The recipe cross-builds forgeext from the working tree, and that
binary ran the verify-and-install cases on the bench reference (image
20260920211625, from /tmp, with the board's own fwup 1.16.0 and the
image's keyring) with the results of the host test. forgefirm-keys builds
and packages the key 0644 under ext/ (0755), byte-identical to the file
here; it is 32 key bytes and is not the release key.

Acceptance. No catalog test reads either yet: forgeext's tests are the
exthost suite that comes with its daemon, and the key is layer content, in
the platform identity of every fingerprint.

meta-forgefirm/recipes-forgefirm/forgeext/forgeext.bb

@@ -0,0 +1,25 @@
+# SPDX-License-Identifier: MIT
+
+DESCRIPTION = "Extension host for ForgeFIRM powered Glowforge"
+HOMEPAGE = "https://github.com/openglow-org/forgeext"
+
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=785c97b59b518e7ad943cd9e8b15fc97"
+
+SRC_URI = "git://github.com/openglow-org/forgeext.git;protocol=https;branch=main"
+# SRCREV and PV live in the pin file (forgefirm-image-manifest.bbclass).
+require forgeext-pin.inc
+
+S = "${WORKDIR}/git"
+
+inherit cmake pkgconfig forgefirm-manifest
+
+# jansson (the manifest, state.json, every answer), libarchive (the .ffx and
+# its payload, read streaming), libsodium (the archive's signature and the
+# blake2b-256 of the payload and of every installed file).
+DEPENDS += "jansson libarchive libsodium"
+# fwup reads an archive's metadata and task list the way the firmware
+# paths would; the keyring holds the keys that sign firmware, which an
+# extension is never signed with; forgefirm-sandbox is the account pool,
+# the cgroup tree, and the deny rules a package's service runs inside.
+RDEPENDS:${PN} = "fwup forgefirm-keys forgefirm-sandbox"