fix(build): Verify cachyos and chaotic-aur signatures at ISO build time

Both repos used SigLevel = Optional TrustAll, so unsigned or tampered
packages went straight into the ISO. Inherit Required DatabaseOptional
from [options] and have build-iso import + lsign both signing keys.

Also in build-iso: detach only loop devices backed by the work dir
(losetup -D hit every loop on the runner host) and drop the ?token=
download fallback that put the API token into access logs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/build-iso.yaml

@@ -101,6 +101,36 @@ jobs:
             exit 1
           fi
 
+      - name: Trust cachyos and chaotic-aur signing keys
+        run: |
+          set -euo pipefail
+          # The profile's pacman.conf verifies [cachyos] and [chaotic-aur]
+          # signatures (SigLevel inherited from [options]); mkarchiso's
+          # pacstrap checks them against the host keyring.
+          #   F3B607488DB35A47  CachyOS <admin@cachyos.org>
+          #   3056513887B78AEB  chaotic-aur (Pedro Henrique Lara Campos)
+          for key in F3B607488DB35A47 3056513887B78AEB; do
+            if pacman-key --list-keys "$key" >/dev/null 2>&1; then
+              echo "  ✅ $key already in the keyring"
+            else
+              got=0
+              # Retry: gateway drops UDP/53 in bursts (see run 131)
+              for try in 1 2 3 4 5; do
+                if pacman-key --recv-keys "$key" --keyserver keyserver.ubuntu.com; then
+                  got=1
+                  break
+                fi
+                echo "  ⚠️ recv-keys $key failed (attempt $try/5), retrying in $(( try * 15 ))s..." >&2
+                sleep $(( try * 15 ))
+              done
+              if [ "$got" -ne 1 ]; then
+                echo "❌ Could not fetch signing key $key" >&2
+                exit 1
+              fi
+            fi
+            pacman-key --lsign-key "$key"
+          done
+
       - name: Ensure /dev/fd symlinks exist for mkinitcpio and procsub
         run: |
           set -euo pipefail
@@ -503,13 +533,11 @@ jobs:
             url="$GITEA_ORIGIN/$REPOSITORY/releases/download/$TAG_NAME/$enc_fname"
             downloaded=0
             for attempt in 1 2 3; do
-              # Try header auth, then ?token=, then anonymous (public repo).
+              # Try header auth, then anonymous (public repo). No ?token=
+              # fallback: a token in the query string lands in access logs.
               if curl -sfL --max-time 600 -H "Authorization: token $GITEA_TOKEN" \
                   "$url" -o "$tmpdir/$fname"; then
                 downloaded=1
-              elif curl -sfL --max-time 600 "$url?token=$GITEA_TOKEN" \
-                  -o "$tmpdir/$fname"; then
-                downloaded=1
               elif curl -sfL --max-time 600 "$url" -o "$tmpdir/$fname"; then
                 downloaded=1
               fi
@@ -572,8 +600,11 @@ jobs:
           # Unmount any leftover loop devices or bind mounts in the work directory
           $PRIV umount -R "$PWD/work" 2>/dev/null || true
 
-          # Clean up loop devices if any remain attached to the work dir
-          $PRIV losetup -D || true
+          # Detach only loop devices backed by files in our work dir:
+          # `losetup -D` would detach every loop device on the runner host.
+          $PRIV losetup -nO NAME,BACK-FILE 2>/dev/null \
+            | awk -v w="$PWD/work/" 'index($2, w) == 1 {print $1}' \
+            | while read -r dev; do $PRIV losetup -d "$dev" || true; done
 
           # Remove working directories with proper permissions
           $PRIV rm -rf "$PWD/work"