fix(void): wire signed xbps repo into release, README, and release process

Add build-xbps tag job to release.yml: verifies the tag against
src/vocalinux/version.py, fails closed when XBPS_SIGNING_KEY is unset,
builds and signs via podman-only repo.sh, and attaches packages,
signatures, repodata, and client key files to the release. Fold the
xbps-repo artifact into publish-checksums (manifest + SHA256SUMS).

Document the Void install in the root README (glibc x86_64 scope,
fingerprint check, third-party repo caveat) and the post-tag template
version/checksum bump as a pull request in docs/RELEASE_PROCESS.md.

Proof: local podman run with a throwaway RSA4096 key built all four
templates, signed packages + repodata, and verified voculinux installs
from the signed repo in a clean rootdir (fingerprint
eb:29:5d:9e:5c:94:c1:63:ae:35:cd:35:db:7a:28:da).

docs/RELEASE_PROCESS.md

@@ -54,6 +54,7 @@ Use this checklist for every release:
 - [ ] `docs/INSTALL.md` - Verify install examples use `main/install.sh` (not version-pinned raw URLs)
 - [ ] `docs/UPDATE.md` - Add "What's New" section for new version
 - [ ] `SECURITY.md` - Update supported versions table
+- [ ] `packaging/void/srcpkgs/` - After the tag, bump template `version`/`checksum` to the new release as a pull request (never direct to `main`)
 
 ### Website
 - [ ] `web/src/app/page.tsx` - Update `softwareVersion` in schema
@@ -310,6 +311,19 @@ Update the supported versions table:
 | < 0.4   | :x:                |
 ```
 
+#### 3.5 Update Void templates (pull request)
+
+After the tag is cut, the Void templates in `packaging/void/srcpkgs/` must
+point at the new release: bump `version` in the `voculinux` template (and
+any template whose upstream moved) and refresh every pinned `checksum`
+(`sha256` sums of the release sdist and distfiles). Land the bump as a
+**pull request** through the normal test, lint, and type gates — never as
+a direct or bot commit to `main`, and never hand-edited onto the release
+itself (see `just verify-release`). `tests/test_void_app_template.py`
+fails if the template version or checksum drifts from
+`src/vocalinux/version.py` and the published sdist, and the signed xbps
+repository for the *next* release builds from these templates.
+
 ### Step 4: Update Website
 
 #### 4.1 Update `web/src/app/page.tsx`