Defer all GPG work to signing time

[Xarthisius]

TRO.__init__ spawned a gpg process, resolved the configured fingerprint against the local keyring, and wrote the exported public key into the declaration — on every instantiation, whatever the caller intended to do. This moves all of it to signing time.

• No keyring, no gpg binary to construct a TRO, add arrangements or performances, save, report or verify-timestamp. A missing key no longer surfaces as KeyError(<fingerprint>) from a constructor, but as RuntimeError naming the key and the keyring, at signing time. import gnupg is lazy too, so the package works without python-gnupg installed.
• trov:publicKey is now structurally the signing key. Previously every TRO(...) overwrote it from its own keyring, so a long-lived TRO ended up with whatever the last process to touch it had - and any write after signing silently replaced the key the .sig was computed over. sign now attaches the key, saves, and only then hashes and signs, so the declaration on disk, the .sig and the .tsr always agree by construction.

Changes: __init__ stores config only; new lazy _gpg(), _resolve_key_id() and attach_public_key(); request_timestamp() attaches the key and saves before hashing. cli.py unchanged. tro.gpg is no longer a public attribute - the only in-repo user was a test helper.

Compatibility: existing signed TROs are unaffected; nothing about the signature or timestamp format changes. trov:publicKey is defined but not required by the schema, so pre-signing declarations stay valid without it. A profile-supplied trov:publicKey now survives until signing replaces it.

Tests: the create_tro_with_gpg helper loses its hand-assembly workaround and passes the fingerprint through normally. New coverage: key absent after a plain save() and present after signing; build-and-save against an empty keyring; a test proving GPG is never reached outside signing; and a round-trip test asserting the timestamped payload matches what a keyless verifier recomputes from the saved files - confirmed to fail if the injection is moved into trs_signature(). 146 passing.

Docs: README.md, docs/installation.md and docs/usage.md now mark GPG as needed for sign only, and the Python example no longer calls trs_signature() before request_timestamp() (that would write a .sig predating the key injection).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.43%. Comparing base (95ec41b) to head (cc4f145).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #31      +/-   ##
==========================================
+ Coverage   95.08%   95.43%   +0.35%     
==========================================
  Files          15       15              
  Lines        1057     1074      +17     
==========================================
+ Hits         1005     1025      +20     
+ Misses         52       49       -3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.