Document Gitea Arch DB-signing key import for [tanin]

The Gitea Arch registry signs the repo DB with its own key
(63F0415879323F6BFE0FBFB2B6FDF356206AF4F6); import it via
.../arch/repository.key + pacman-key --lsign-key before -Sy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

distro/tanin.pacman.conf

@@ -1,6 +1,18 @@
 # [tanin] — TANINUX (camel) binary repo, hosted on the Gitea Arch registry.
-# Append this block to /etc/pacman.conf, then:  sudo pacman -Sy
+#
+# The Gitea Arch registry SIGNS the repo DB with its own key, so that key must
+# be imported + locally signed first (one time), then add the repo block below.
+#
+#   curl -s https://git.openbureau.ch/api/packages/karim/arch/repository.key \
+#     | sudo pacman-key --add -
+#   sudo pacman-key --lsign-key 63F0415879323F6BFE0FBFB2B6FDF356206AF4F6
+#
+# Then append this to /etc/pacman.conf and:  sudo pacman -Sy
 #   sudo pacman -S tanin-desktop      # pulls the whole niri/eww desktop
+#
+# (Quick alternative without importing the key: set `SigLevel = Never` below —
+#  less secure, skips all signature checks. The ISO/Calamares should import the
+#  key into the live + target keyring instead.)
 [tanin]
 SigLevel = Optional TrustAll
 Server = https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch