chore(trust): flip the signing checks to the new release root

v1.7.122-alpha was the last release signed with the old root — it is the
release that installed the new pin on every node. From v1.7.123 the new
root signs, and a node running .122+ rejects an old-key signature. The
ARCHY_RELEASE_ROOT_PUBKEY override is no longer needed either: the signer
built from this tree pins the same key we now sign with.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/sign-manifest.sh

@@ -12,18 +12,9 @@
 # re-signing (e.g. a manifest edited after creation) or signing on a box where
 # the release run was non-interactive.
 #
-# ⚠ ROTATION IN FLIGHT (v1.7.122-alpha). This release must be signed with the
-# OLD release root, because every node still runs a binary pinning it — but
-# the signer built from THIS tree already pins the NEW root, so its own
-# verification would reject a correct old-key signature. Pin the old anchor
-# for the duration of the ceremony so signing and verification agree:
-#
-#   ARCHY_RELEASE_ROOT_PUBKEY=5d15cbee8a108f7dd288c02d29a1d9d71f198acc99186aad8008b4f28d469951 \
-#     bash scripts/sign-manifest.sh
-#
-# That hex is the OLD root's PUBLIC key (verified to derive to
-# did:key:z6Mkkid…q7ur); it is not secret and pins verification only.
-# From v1.7.123 the override is unnecessary — drop it and this block.
+# The release root was rotated 2026-08-05. From v1.7.123 this signs with the
+# NEW mnemonic and the signer's own anchor already pins that key, so no
+# ARCHY_RELEASE_ROOT_PUBKEY override is needed (it was, for .122 only).
 set -euo pipefail
 
 REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"