ci: a release refuses an unsigned build

Captain Bob, 2026-11-12: "release MUST refuse unsigned builds". release.yml's
"The capsule-signing key" step warned when CAPSULE_SIGN_KEY was missing and the
release went on, unsigned. Now it is an ::error:: and the step fails, as the
gate into master's does (#174). build.yml and nightly.yml still warn.

scripts/test_acceptance_signing.sh now takes the step from both acceptance.yml
and release.yml as CI runs them. Against release.yml as it was: the release's
unsigned case passed, no error -- 2 failures (acceptance's 3 checks passed).
Now 6 checks, all pass. logs/20261112-205446/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RzZgrf7V7Zk2iczBXDRbm

.gitea/workflows/release.yml

@@ -39,6 +39,9 @@ jobs:
           fetch-depth: 0
           lfs: false
 
+      # A release refuses an unsigned build (Captain Bob, 2026-11-12: "release MUST refuse unsigned
+      # builds"), as the gate into master does (#174). It warned and went on.
+      # scripts/test_acceptance_signing.sh runs this step.
       - name: The capsule-signing key
         env:
           KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
@@ -48,7 +51,8 @@ jobs:
             (umask 077; printf '%s\n' "$KEY" > "$f")
             echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
           else
-            echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
+            echo "::error::No CAPSULE_SIGN_KEY secret: a release is not built unsigned."
+            exit 1
           fi
 
       - name: The tag names the tree's version