feat: Integración de Siguldry PKCS#11 y spooler de firmas

* Implementación del rol de Ansible 'siguldry' para CentOS Stream 10
* Migración del plugin de firmas de Koji Hub a un spooler asíncrono
* Modificación de roles para utilizar empaquetamiento RPM nativo de siguldry-pkcs11
* Documentación de decisiones (ADRs) y roadmap en docs/technical/
* Limpieza de binarios locales pesados de PKCS#11 en Ansible

Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>

roles/koji_hub/tasks/main.yaml

@@ -304,6 +304,52 @@
     mode: "0644"
   notify: Restart httpd
 
+- name: Copy Sigul signing plugin to Koji Hub plugins directory
+  ansible.builtin.copy:
+    src: sigul_sign.py
+    dest: /usr/lib/koji-hub-plugins/sigul_sign.py
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart httpd
+
+- name: Create spool directories for Koji signing
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: apache
+    group: apache
+    mode: "0770"
+  loop:
+    - /var/spool/koji-sign
+    - /var/spool/koji-sign/queue
+    - /var/spool/koji-sign/failed
+
+- name: Copy Koji sign spooler daemon to libexec
+  ansible.builtin.copy:
+    src: koji-sign-spooler
+    dest: /usr/libexec/koji-sign-spooler
+    owner: root
+    group: root
+    mode: "0755"
+  notify: Restart koji-sign-spooler
+
+- name: Copy Koji sign spooler systemd service
+  ansible.builtin.copy:
+    src: koji-sign-spooler.service
+    dest: /usr/lib/systemd/system/koji-sign-spooler.service
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart koji-sign-spooler
+
+- name: Enable and start koji-sign-spooler service
+  ansible.builtin.systemd:
+    name: koji-sign-spooler
+    state: started
+    enabled: true
+    daemon_reload: true
+
 - name: Template Koji callback script
   ansible.builtin.template:
     src: koji_callbacks.py.j2