doos 1.1.0: limits, hardening, pasta, signatures, Debian image

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/image.hpp

@@ -15,6 +15,10 @@ struct ImageSource {
     std::string location;         // https URL or local file path
     std::string sha256;           // expected, empty only for local files
     bool isFile = false;
+    // Optional detached signature over the downloaded file; the key is fetched and must match the pinned fingerprint.
+    std::string sigUrl;
+    std::string keyUrl;
+    std::string keyFpr;
 };
 
 struct ImageInfo {
@@ -25,7 +29,8 @@ struct ImageInfo {
     std::uint64_t bytes = 0;
 };
 
-// Built-in sources: alpine, ubuntu (latest LTS), ubuntu-VERSION. Resolved from the publishers over https.
+// Built-in sources: alpine, ubuntu (latest LTS), ubuntu-VERSION, debian, debian-RELEASE. Resolved from the
+// publishers over https; Alpine and Ubuntu are also checked against their pinned release signing keys.
 class Catalog {
 public:
     static std::vector<std::string> names();