ci: bump theQRL/actions-mldsa-sign from 1.0.0 to 2.0.0

[dependabot]

Bumps theQRL/actions-mldsa-sign from 1.0.0 to 2.0.0.

Release notes

Sourced from theQRL/actions-mldsa-sign's releases.

v2.0.0 — signed release manifests

Adds a signed release manifest binding each artifact's digest to its filename, product and tag, so verifiers can establish which release a file is — not just that it was signed.

Breaking: manifests are on by default. A context that does not end in -release-signatures now fails unless product is set. Set manifest: '' for v1 behaviour.

New inputs: product, tag, manifest, manifest-context. backfill-manifest.sh signs a manifest for a release published before v2.

Changelog

Sourced from theQRL/actions-mldsa-sign's changelog.

Release Process

No semantic-release here, unlike qrlft. Releases are cut by hand: a release is a git tag plus a container image that action.yml pins by exact version, and nothing derives one from the other.

What ships

Artefact	Produced by	Referenced by
Tag vX.Y.Z	git push origin vX.Y.Z	Exact-version pins
Tag vX (floating)	Moved each release in that major	uses: theQRL/actions-mldsa-sign@vX
Image ghcr.io/theqrl/actions-mldsa-sign:vX.Y.Z	ci.yml, on the tag push	action.yml's image:

action.yml pins the image by exact version, never by floating tag, so the image under a consumer cannot change without a tag moving.

Versioning

Semver, judged by what a verifier has to change rather than what a workflow author would notice.

Major — anything that changes the bytes signed, the context they are signed under, or an existing verification procedure:

• how the manifest context is derived from the product
• the manifest's schema, field names, sort order or formatting (a verifier that rebuilds and compares breaks; signatures already issued stay valid)
• an optional input becoming required
• bumping the pinned qrlft

Minor — new optional inputs or outputs.

Patch — fixes that change no output for any input that previously succeeded.

The manifest carries schema, currently theqrl.release-manifest.v1. A shape change means a new schema string and a major version.

Pre-flight

./test/run.sh

15 assertions against a real qrlft: context separation, the refusals, and a byte-identical rebuild. Needs Go and jq; set QRLFT to reuse a binary.

Then the image, which test/run.sh does not cover:

</tr></table> 

... (truncated)

Commits

• 266287a docs: update README
• dfbb525 feat: backfill manifests
• acc5f4b feat!: manifest added
• dd421c0 Add MIT license and correct Dilithium hexseed migration note
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[netlify]

✅ Deploy Preview for qrl-webtools ready!

Name	Link
🔨 Latest commit	92d7343
🔍 Latest deploy log	https://app.netlify.com/projects/qrl-webtools/deploys/6abc6765dbad3700081f278e
😎 Deploy Preview	https://deploy-preview-21--qrl-webtools.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.