[ioquatix]

Summary

• Copy the Socketry Ruby Gems public certificate exactly from the current socketry/bake-modernize main branch.
• Align the local signing key path with ~/.gem/socketry-release.pem.
• Retain the existing package file list: the public certificate remains a build input referenced by spec.cert_chain, rather than a payload file.
• Use the existing organization GEM_SIGNING_KEY secret, already available to this repository and wired into the publishing workflow.

This completes the certificate configuration following #61. The rubygems environment is restricted to main, all four release rulesets are active, and the Trusted Publisher registration has been completed by the maintainer.

Verification

• Public certificate matches bake-modernize byte-for-byte, has a valid self-signature, and is valid until September 21, 2027.
• Unsigned gem builds successfully; verified release.cert is excluded from its payload and spec.cert_chain remains configured.
• bundle exec rubocop protocol-http1.gemspec — passed after correcting the package file list.
• The initial certificate update also passed the full test suite (207 tests, 581 assertions), full RuboCop, documentation coverage (84/84), and ordinary-PR release validation.