Add Linux code signing in Docker

### What is the problem or limitation you are having?

PR #2973 added support for code signing Linux system packages - but only when running natively. If you use `--target` to build a package in a Docker container, code signing fails.

### Describe the solution you'd like

It should be possible to build and sign a Linux package inside a Docker container.

There's no changes needed to the general workflow - identity selection etc can continue as currently defined. The signing identity and gnupg must exist on the "host" machine (which may be a macOS machine). However, as part of container preparation, the Docker container must have the required tools installed, and the chosen signing identity must be injected into the Docker container (presumably by exporting the key from the local machine, and adding it to the keychain inside the Docker container). The signing step must also occur inside the Docker container.

### Describe alternatives you've considered

Status quo - only allow "native" signed package builds. This isn't ideal, as Docker builds are a major usability affordance.

### Additional context

_No response_

Start with PR #2973 and the existing native Linux package-signing flow, then trace Docker target preparation and signing. Confirm which tools and signing identity data are available inside the container. Done means a Linux package can be built and signed through --target in Docker while preserving the existing identity-selection workflow.

Written by the indexing model from the issue text.