test: exercise real WKD and HKPS discovery in isolated CI

.github/workflows/check.yml

@@ -44,3 +44,27 @@ jobs:
           path: /tmp/quickly-browser-artifacts
           if-no-files-found: ignore
           retention-days: 7
+  live-discovery:
+    name: Live public GPG discovery (external network)
+    runs-on: ubuntu-latest
+    timeout-minutes: 6
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: '22'
+      - name: Ensure actual GnuPG network dependencies
+        run: |
+          if ! command -v gpg >/dev/null || ! command -v dirmngr >/dev/null; then
+            sudo apt-get update
+            sudo apt-get install -y gnupg dirmngr
+          fi
+          gpg --version
+          dirmngr --version
+      - name: Discover the fixed public test certificate through WKD and HKPS
+        # This fixture is ONLY a public integration-test identity. Fork owners
+        # must not replace it with their deployment identity or production keys.
+        # No installer, system trust changes, signing, or SSH configuration runs.
+        run: node scripts/test-live-discovery.mjs