Initialize pacman keys in build containers (#376)

Recreate pacman's local signing key before upgrading packages so keyring install scripts can sign trusted keys. Keep the key out of the builder image and exercise keyring population with a keyless test image.

build/build.sh

@@ -88,6 +88,10 @@ if [[ "$DRY_RUN" != true ]]; then
 
   mkdir -p "$BUILD_OUTPUT_DIR" "$FINAL_OUTPUT_DIR"
 
+  # The image drops pacman's private signing key. Keyring upgrades need a
+  # container-local key to sign newly trusted keys.
+  sudo pacman-key --init || exit 1
+
   # Bring the container up to date before any makedepends are installed. The
   # image is layer-cached, so its glibc drifts behind the mirror while makepkg
   # -s pulls makedepends from the freshly synced database -- a partial upgrade