feat(github): share the Terraform Registry signing key with provider repos

[thecluster-claude]

Adds GPG_PRIVATE_KEY and PASSPHRASE as organization Actions secrets, visible to terraform-provider-atproto and terraform-provider-netgear.
Their goreleaser workflows already read these names.

The Terraform Registry verifies a release against any key registered on the namespace, so one key for all unmango providers is as safe as one per provider and simpler to manage.
The registry accepts only RSA and DSA keys, which rules out netgear's current ECDSA key; this uses a new RSA 4096 key.

Before this can merge

This is a draft because the values come from stack config that has to be set from a machine holding the key:

gpg --armor --pinentry-mode loopback --passphrase "$PASS" --export-secret-keys "$FPR" | pulumi config set --secret releaseGpgPrivateKey
pulumi config set --secret releaseGpgPassphrase "$PASS"

Commit the resulting Pulumi.prod.yaml change to this branch.

After merge

• terraform-provider-netgear has repo-level secrets with the same names, which take precedence over organization secrets. Delete them so it picks up the new key.
• The GitHub App needs the organization "Secrets" permission (read and write) for the deploy to create these.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: e6a9bcf0-6731-4c2a-8b46-e2cbd29ffffd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}