fix(jetbrains): avoid writing release signing secrets

[kirillk]

Summary

• Restore raw-content JetBrains signing inputs for CI so release workflows do not write signing secrets to temp files.
• Keep file-path signing inputs for local release builds that already use pre-existing secret files.
• Run the bundled signing, signature verification, and plugin verification in one Gradle invocation with an explicit verifyPluginSignature -> signPlugin dependency.

Context

The bundled release failure started as a Gradle 9 implicit dependency error between verifyPluginSignature and signPlugin. Splitting those tasks into separate invocations avoided that error but exposed raw multiline PEM handling in zip-signer, leading to temp-file secret writes. This fixes the original task dependency directly and keeps the Marketplace publish path on the historically working raw-secret publishPlugin flow.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• .github/workflows/publish-jetbrains-bundled.yml
• packages/kilo-jetbrains/build.gradle.kts

---

_{Reviewed by claude-sonnet-5 · Input: 30 · Output: 9.3K · Cached: 974.5K}

_{Review guidance: REVIEW.md from base branch main}