docs(planning): D17 (SSH tag signing) + close §5a item 1

Closes §5a item 1 (tag signing) end-to-end. Adds D17 to §1 Decisions
capturing the SSH path + RelativisticJet identity choice and the
subtle finding that surfaced during E2E verification.

D17 summary: ed25519 key SHA256:QIzLvkfiF/tdy2M9m5HDEC3wJstge+NWBiGeEJ5KuNo
uploaded to RelativisticJet GitHub account as both Authentication
and Signing key (GitHub policy requires both types to be uploaded
separately even when the key material is identical). Per-repo git
committer set to "Oleh Bezsonov <20013626+RelativisticJet@users.
noreply.github.com>" so tagger email maps to the account owning
the signing key.

Why per-repo (--local) and not --global: the user maintains a
separate wildleo91 identity for personal projects. --local keeps
the RelativisticJet attribution scoped to this repo while leaving
the global default alone.

End-to-end verification this turn:
  1. Generated key, no passphrase
  2. Uploaded both Authentication + Signing types to RelativisticJet
  3. Configured git globally: gpg.format=ssh, user.signingkey,
     tag.gpgsign=true, gpg.ssh.allowedSignersFile
  4. Configured git locally for this repo: user.name="Oleh Bezsonov",
     user.email=<RelativisticJet noreply>
  5. Cut v0.0.0-tag-signing-test, verified locally
  6. First push: GitHub returned verified=false, reason=no_user -
     diagnosed as committer-email-vs-signing-key-account mismatch
  7. Deleted bad test tag, switched git identity, updated
     allowed_signers, re-cut
  8. Second push: GitHub returned verified=true, reason=valid
  9. Deleted the (now-verified) test tag both local and origin

Historical commits in this repo remain attributed to wildleo91.
No history rewrite - would invalidate any existing forks and the
prior attribution is internally consistent.

§5a status: 4/4 items closed pre-Phase-1. Doc-drift hook passes
on all 28 docs.

Author: RelativisticJet

docs/PUBLIC_RELEASE_PLAN.md

@@ -41,6 +41,7 @@ explicit user re-decision.
 | D14 | **Plan persistence: this document, committed at `docs/PUBLIC_RELEASE_PLAN.md`** | Survives session transitions. Becomes public-facing when repo flips — trust signal showing deliberate process. |
 | D15 | **Splunk Developer / Splunkbase publisher name: "Oleh Bezsonov"** (real name, not `@RelativisticJet` handle). Account email: `communicate.oleh@gmail.com`. Created at dev.splunk.com 2026-05-13. | Unifies identity with D5 LICENSE copyright. Real name is publicly visible on every Splunkbase listing under this account — trade-off accepted. Avoids future legal-entity transfer friction that a handle-as-brand might create. Matches convention of established Splunkbase community apps (e.g., TrackMe V1 published as "Guilhem Marchand"). Reversible by emailing Splunk Developer Support if an LLC is ever formed. |
 | D16 | **Docs hosting URL: GitHub Pages default (`https://relativisticjet.github.io/wl_manager/`), no custom domain for v1.0.0 GA.** Decided 2026-05-17 during pre-Phase-1 §5a sweep. | Pre-public there are no readers; a custom `.dev` domain costs $15-30/yr ongoing for a vanity URL that nobody is asking for yet. URL portability isn't a concern — both the GitHub handle (`@RelativisticJet`, owned) and the repo name (`wl_manager`) are stable. Brand identity comes from the project name in headings/badges, not the URL bar. Revisit if/when traction warrants a vanity URL or the handle ever changes. Reversal cost: low — buy domain, point a CNAME at `relativisticjet.github.io`, set the domain in GitHub Pages settings + the `site_url` field in `mkdocs.yml`. ~1 hour after domain purchase. |
+| D17 | **Tag-signing path: SSH (key reused for auth + signing) under RelativisticJet identity.** ed25519 key `SHA256:QIzLvkfiF/tdy2M9m5HDEC3wJstge+NWBiGeEJ5KuNo` uploaded to the RelativisticJet GitHub account as both Authentication and Signing key. Per-repo git committer set to `Oleh Bezsonov <20013626+RelativisticJet@users.noreply.github.com>` so signature verification ties to the account owning the signing key. End-to-end verified 2026-05-17 via throwaway test tag (GitHub returned `verified=true, reason=valid`). | Alternatives considered: (a) GPG-key signing via Gpg4win — more setup, broader downstream tool support, but the Git-bundled GPG 2.4.9 is keyboxd-broken on Windows so it requires installing a full Windows GPG distribution; (b) keep `wildleo91` git identity and upload the same signing key to the `wildleo91` GitHub account too — lowest friction but leaves the repo-owner-vs-commit-author mismatch in the public eye. SSH won because: simpler setup, no extra software install on Windows, Git ≥ 2.34 supports it natively (norm since late 2021, well before any plausible production-Splunk install date). The identity switch to RelativisticJet was orthogonal but landed in the same change because tag verification requires the tagger email to map to the account that owns the signing key — this unifies the public face of the repo: commit author + repo owner + Splunk publisher (D15) + LICENSE copyright (D5) all read "Oleh Bezsonov" / RelativisticJet going forward. Historical commits remain attributed to `wildleo91` — no history rewrite, since rewriting would invalidate any existing forks and the prior attribution is internally consistent. | Low — to switch to GPG: install Gpg4win, generate key, upload to GitHub, change `git config gpg.format=openpgp` and `user.signingkey=<gpg-keyid>`. To revert to wildleo91 identity for this repo: `git config --local --unset user.email && git config --local --unset user.name` (falls back to the global config). The signing key itself doesn't change in either reversal — it's the orchestration around it. |
 
 ---
 
@@ -210,7 +211,7 @@ These nice-to-haves were surfaced during the 2026-05-15 gap review alongside G2-
 
 | Optional item | Status | Rationale | Est. |
 |---|---|---|---|
-| Tag signing (SSH or GPG) | ⏳ procedure landed 2026-05-16 (`docs/RUNBOOKS.md` "Tag Signing — SSH or GPG"); awaiting user key generation + GitHub upload + path-A-or-B decision | Orthogonal to Sigstore `.spl` signing — some FOSS users verify tag signatures as well as artifact signatures. Two paths documented: SSH (simpler, reuses GitHub SSH key) and GPG (traditional, needs Gpg4win on Windows because the Git-bundled GPG 2.4.9 is keyboxd-broken). Locked-decision row TBD in `docs/DECISION_LOG.md` once the user picks a path and uploads a public key. | 30 min including key generation (after Gpg4win install if path B) |
+| Tag signing (SSH or GPG) | ✅ closed 2026-05-17 (locked at D17 in §1; SSH path, RelativisticJet identity, GitHub verified=true on throwaway test tag) | Two paths documented in `docs/RUNBOOKS.md` "Tag Signing — SSH or GPG". SSH won (lower setup cost, no extra software install on Windows, Git ≥ 2.34 supports natively). One subtle finding during E2E verification: the local git committer must map to the GitHub account that owns the signing key, otherwise GitHub returns `verified=false, reason=no_user`. Fixed by setting per-repo `user.email=20013626+RelativisticJet@users.noreply.github.com`, which unifies future commit attribution with repo ownership + D5 LICENSE copyright + D15 Splunk publisher identity. Historical commits remain attributed to wildleo91; no history rewrite. Full rationale in D17. | 30 min including key generation (after Gpg4win install if path B) |
 | `.github/FUNDING.yml` | ✅ stub landed 2026-05-16 (`.github/FUNDING.yml`, all platforms commented out) | Enables sponsor links (GitHub Sponsors, Ko-fi, etc.) on the repo sidebar. Zero cost to add; trivial to remove. Stub renders no Sponsor button until at least one platform is uncommented; uncommenting requires the maintainer to have onboarded with that platform first (an empty handle would 404 the Sponsor button). | 5 min |
 | Continuous secret scanning (`gitleaks-action`) | ✅ landed 2026-05-16 (`.github/workflows/secret-scan.yml` + `.gitleaks.toml`) | Phase 0.10 was a one-shot scan of historical commits. The CI gate catches future regressions on push to main + every PR + weekly schedule + manual dispatch. The `.gitleaks.toml` allowlist encodes the Phase-0.10-accepted false-positives (`Chang3d!` dev container password + `audit.xml` SimpleXML dashboard tokens) so recurring runs don't refire on them. | 15 min |
 | Custom domain for the hosted docs site | ✅ DECIDED 2026-05-17 — **no custom domain for v1.0.0 GA** (see D16 in §1) | Locked at D16: GitHub Pages default URL `https://relativisticjet.github.io/wl_manager/` is the permanent docs URL through v1.0.0 GA. Revisit if/when traction warrants a vanity URL or the GitHub handle ever changes. Reversal is low-cost (domain + DNS CNAME + one config field). | n/a — decision made |