fix(ci): eliminate audit-signature flake + self-heal deploy docker access

Two comprehensive CI fixes:

1. Adversarial harness flake (PASS=42 FAIL=2, state-dependent):
   governance-check.sh re-exported audit-public.pem only when GENERATING a
   new signing key. On a CI runner where the off-repo private key PERSISTS
   across runs, the checked-out (Vault-signed) audit-public.pem drifted out
   of sync with the local re-signing key, so verify-audit-chain.sh rejected a
   genuine head ("H5/H2 verifies the genuine signed chain"). Now always
   re-export the public key matching the signing key — mirrors the same fix
   already applied to tool-audit-lib.sh (c31987c). Reproduced the exact
   FAIL=2 locally with a drifted persisted key; now deterministically 44/44.

2. Deploy docker.sock permission denied:
   Added a self-healing preflight to deploy-okr that ensures the deploy user
   is in the docker group on the web VPS (idempotent, passwordless sudo) and
   proves a fresh SSH session can reach the daemon before streaming images.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -170,6 +170,24 @@ jobs:
           ssh-keyscan -H 161.33.139.73 >> ~/.ssh/known_hosts 2>/dev/null
           echo "SSH ready: $(ssh-keygen -l -f ~/.ssh/deploy_key 2>&1)"
 
+      - name: Ensure docker access on web VPS (self-heal group membership)
+        run: |
+          # The deploy user must be in the 'docker' group to reach
+          # /var/run/docker.sock (root:docker, mode 660). Idempotent; self-heals
+          # a rebuilt web VPS. Each subsequent step opens a fresh SSH session, so
+          # the new group membership takes effect without a reboot.
+          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS '
+            if id -nG "$USER" | tr " " "\n" | grep -qx docker; then
+              echo "docker group: already a member"
+            else
+              echo "docker group: adding $USER"
+              sudo usermod -aG docker "$USER"
+            fi
+          '
+          # Prove a NEW session can reach the docker daemon before streaming ~GBs.
+          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS \
+            'docker version --format "server={{.Server.Version}}"'
+
       - name: Build backend image (node:20-slim + Prisma MySQL)
         run: docker build -t okr-backend:latest -f Dockerfile.backend .