Resolve packages exporter sign key deterministically

[anfimovdm]

Fixes AlmaLinux/build-system#547

Problem

packages_exporter.py resolved the repodata signing key with next(...) over get_sign_keys(), which returns the first match and silently drops the rest. platforms_sign_keys is many-to-many, and platforms 50 (AlmaLinux-10) and 83 (AlmaLinux-Kitten-10) each have two keys attached:

sign_keys.id	name	keyid
4	AlmaLinux-10	DEE5C11CC2A1E572
367	AlmaLinux-10-EPEL-AltArch	B620C02335D447A6

So repodata for those platforms got signed with whichever key came back first — order-dependent, unlogged, and with no way for the operator to override it.

Changes

scripts/exporters/packages_exporter.py:

• -sw / --sign-with <keyid> — mirrors the flag products_exporter.py already has. Validated against get_sign_keys() before any export work; when set it overrides the per-platform lookup for every exported repo, so signing the AltArch repos with B620C02335D447A6 is now expressible. An unknown keyid aborts up front.
• get_platform_sign_key_id() replaces both next(...) lookups (the per-repo one in sign_repodata() and the --release-id one in main()):
  • no key for the platform → None, as before;
  • exactly one key → that keyid;
  • several keys including DEFAULT_SIGN_KEY_ID (DEE5C11CC2A1E572) → the default, plus a warning naming every candidate;
  • several keys, none of them the default → AmbiguousSignKeyError pointing at --sign-with.
• Fail-fast validation of the exported platforms right after export_repos_from_pulp(), so an unresolvable key surfaces before post-processing, errata, OVAL and RSS generation instead of at the very end of the run. Platforms with no exported repos are skipped, since export_repos_from_pulp() seeds platforms_dict with an entry for every non-reference platform.

Behaviour

platform	before	after
single-key (e.g. 1, 9, 16)	its own key	unchanged
50 / 83	either key, order-dependent	DEE5C11CC2A1E572 + warning naming both
any, with --sign-with	not possible	the requested key, for every repo
several keys, no default among them	arbitrary key	aborts, asks for --sign-with

Testing

Key-resolution logic exercised directly against the four-key fixture matching production's platforms_sign_keys rows: platform 50 and 83 → DEE5C11CC2A1E572 with the warning, single-key platform → its own key, unknown platform → None, and a synthetic two-key platform without the default → AmbiguousSignKeyError.

The exporter itself was not run end to end — that needs a live DB and sign server. Worth a manual --platform-names AlmaLinux-10 run against staging before merge to confirm the signed repodata carries DEE5C11CC2A1E572.

Note for reviewers

--sign-with applies to the whole run. Exporting several platforms at once and wanting a different key per platform isn't expressible — that needs separate runs today. Happy to add a per-platform mapping if that's a real workflow.