feat: add ML-DSA-65 post-quantum signing to release workflow

Add a sign-releases job that signs all release archives with ant-keygen
using ML-DSA-65 (FIPS 204) signatures. Generates SHA256SUMS.txt and
attaches both .sig files and checksums to the GitHub release. Uses
context "ant-release-v1" for domain separation from ant-node releases.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jacderida

.github/workflows/ant-cli-release.yml

@@ -210,6 +210,70 @@ jobs:
           path: ${{ github.workspace }}\smctl-signing.log
           if-no-files-found: ignore
 
+  sign-releases:
+    name: sign release artifacts
+    runs-on: ubuntu-latest
+    needs: [build, sign-windows]
+    steps:
+      - name: download all build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - name: download signed windows artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: ant-x86_64-pc-windows-msvc-signed
+          path: artifacts-signed-win
+
+      - name: replace windows archive with signed version
+        run: |
+          rm -f artifacts/ant-*-x86_64-pc-windows-msvc.zip
+          cp artifacts-signed-win/*.zip artifacts/
+
+      - name: download ant-keygen
+        run: |
+          gh release download --repo WithAutonomi/ant-keygen --pattern 'ant-keygen-linux-x64.tar.gz' --dir /tmp
+          tar -xzf /tmp/ant-keygen-linux-x64.tar.gz -C /tmp
+          chmod +x /tmp/ant-keygen
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: decode signing key
+        run: |
+          echo "${{ secrets.ANT_SIGNING_KEY }}" | xxd -r -p > /tmp/signing-key.secret
+          chmod 600 /tmp/signing-key.secret
+
+      - name: sign all release files
+        run: |
+          for file in artifacts/ant-*.tar.gz artifacts/ant-*.zip; do
+            if [ -f "$file" ]; then
+              echo "Signing $file..."
+              /tmp/ant-keygen sign \
+                --key /tmp/signing-key.secret \
+                --input "$file" \
+                --output "${file}.sig" \
+                --context "ant-release-v1"
+            fi
+          done
+
+      - name: clean up signing key
+        if: always()
+        run: rm -f /tmp/signing-key.secret
+
+      - name: generate checksums
+        run: |
+          cd artifacts
+          sha256sum ant-* 2>/dev/null > SHA256SUMS.txt || true
+          cat SHA256SUMS.txt
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: signed-releases
+          path: artifacts/*
+          retention-days: 1
+
   publish-crate:
     name: publish ant-core to crates.io
     runs-on: ubuntu-latest
@@ -228,8 +292,7 @@ jobs:
   release:
     name: create github release
     runs-on: ubuntu-latest
-    needs: [build, sign-windows]
-    if: ${{ !cancelled() && needs.build.result == 'success' && needs.sign-windows.result == 'success' }}
+    needs: [sign-releases]
     steps:
       - uses: actions/checkout@v4
 
@@ -249,23 +312,7 @@ jobs:
 
       - uses: actions/download-artifact@v4
         with:
-          name: ant-x86_64-unknown-linux-musl
-          path: assets/
-      - uses: actions/download-artifact@v4
-        with:
-          name: ant-aarch64-unknown-linux-musl
-          path: assets/
-      - uses: actions/download-artifact@v4
-        with:
-          name: ant-x86_64-apple-darwin
-          path: assets/
-      - uses: actions/download-artifact@v4
-        with:
-          name: ant-aarch64-apple-darwin
-          path: assets/
-      - uses: actions/download-artifact@v4
-        with:
-          name: ant-x86_64-pc-windows-msvc-signed
+          name: signed-releases
           path: assets/
 
       - name: extract changelog entry
@@ -306,6 +353,18 @@ jobs:
           | macOS | `~/Library/Application Support/ant/bootstrap_peers.toml` |
           | Windows | `%APPDATA%\ant\bootstrap_peers.toml` |
 
+          ## Verification
+
+          All release archives are signed with ML-DSA-65 (FIPS 204) post-quantum signatures.
+          Download `ant-keygen` from [WithAutonomi/ant-keygen](https://github.com/WithAutonomi/ant-keygen/releases)
+          and verify:
+
+          ```bash
+          ant-keygen verify --key release-signing-key.pub --input <file> --signature <file>.sig --context ant-release-v1
+          ```
+
+          SHA256 checksums provided in `SHA256SUMS.txt`.
+
           HEADER
 
           echo "## Detailed Changes" >> /tmp/release_body.md
@@ -326,4 +385,7 @@ jobs:
             --title "ant ${{ steps.meta.outputs.version }}" \
             --notes-file /tmp/release_body.md \
             $prerelease_flag \
-            assets/*
+            assets/*.tar.gz \
+            assets/*.zip \
+            assets/*.sig \
+            assets/SHA256SUMS.txt