Default Sparkle public update key

[yvette-carlisle]

Summary

• Ship the Sparkle public EdDSA update key as the default bundled SUPublicEDKey.
• Keep RSNAP_SPARKLE_PUBLIC_ED_KEY as the local Sparkle smoke-test override.
• Remove the release workflow public-key secret requirement and align the release runbook/stage validation.

Validation

• git diff --check
• bash -n scripts/build_and_run.sh
• actionlint .github/workflows/release.yml
• cargo make fmt-toml-check
• python3 /Users/x/.codex/plugins/cache/hack-ink/playbook/0.3.0/scripts/semantic_drift_audit.py (agent verdict: pass)
• cargo make test-macos-native-host-stage