bluebuild(recipe): drop signing module for first green build

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

bluebuild/recipe.yml

@@ -149,8 +149,9 @@ modules:
         - veilor-postinstall.service
         - veilor-doctor.timer
 
-  # ── 10. signing config ──────────────────────────────────────────
-  # bluebuild emits cosign.pub at root; CI uses the pinned key
-  # generated for veilor-org. signed-by reference for bootc upgrade
-  # signature verification.
-  - type: signing
+  # ── 10. signing — DEFERRED ──────────────────────────────────────
+  # The BlueBuild `type: signing` module expects a cosign.pub +
+  # cosign.key pair next to the recipe. Generate + ship those in a
+  # follow-up commit once the operator has rotated the key offline
+  # and stashed cosign.key as a Forgejo Actions secret. Skip for the
+  # first green build.