feat: Integración de Siguldry PKCS#11 y spooler de firmas

* Implementación del rol de Ansible 'siguldry' para CentOS Stream 10
* Migración del plugin de firmas de Koji Hub a un spooler asíncrono
* Modificación de roles para utilizar empaquetamiento RPM nativo de siguldry-pkcs11
* Documentación de decisiones (ADRs) y roadmap en docs/technical/
* Limpieza de binarios locales pesados de PKCS#11 en Ansible

Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>

roles/kojid/tasks/main.yaml

@@ -36,6 +36,13 @@
     groups: mock
     state: present
 
+- name: Ensure system user kojid is in the mock group
+  ansible.builtin.user:
+    name: kojid
+    groups: mock
+    append: true
+    state: present
+
 - name: Ensure /etc/mock/koji has correct permissions
   ansible.builtin.file:
     path: /etc/mock/koji
@@ -107,6 +114,15 @@
     owner: root
     group: root
 
+- name: Configure global Mock bind mount for get-sources script
+  ansible.builtin.blockinfile:
+    path: /etc/mock/site-defaults.cfg
+    block: |
+      # Bind mount the MxOS source fetching wrapper globally
+      config_opts['plugin_conf']['bind_mount_enable'] = True
+      config_opts['plugin_conf']['bind_mount_opts'] = {'dirs': [('/usr/local/bin/mxos-get-sources.bash', '/usr/local/bin/mxos-get-sources.bash')]}
+    marker: "# {mark} ANSIBLE MANAGED BLOCK: MXOS BIND MOUNT"
+
 - name: Configure MxOS Mock config
   ansible.builtin.template:
     src: mxos0-build-x86_64.cfg.j2
@@ -125,3 +141,4 @@
     name: kojid
     state: started
     enabled: true
+