security(updater): complete 2026 release-signing key rollover

The weekly updater key canary now fails because its embedded signature was created by the 2025 key (7EA70A3567E6E8D2), which expires on 2027-02-08. Testing at now + 6 months therefore correctly reports openpgp: key expired.

The 2026 public key added in #3534 expires on 2028-08-18, but it cannot validate the existing signature. This is a rollover-operation task, not a unit-test defect.

Acceptance criteria:

• release a gopass version containing both old and new public keys
• allow the documented adoption window
• create a new canary signature with key 0x66AA0F3E
• update release signing secrets to the new private key
• verify go test -v -tags canary -run ^TestGPGVerifyIn6Months$ ./internal/updater/... passes
• retain the old public key until the supported upgrade window has elapsed

Do not shorten or disable the six-month assertion: it is the intended advance-expiry signal. PR #3538 keeps the signal weekly/on-demand while rollover is in progress instead of failing every unrelated push and PR.