fix: correct package name from sbsigntools to sbsigntool

The package name in Debian repositories is sbsigntool (singular), not
sbsigntools (plural). This typo was causing ISO builds to fail with:
  E: Unable to locate package sbsigntools

Files fixed:
- config/package-lists/knel-football.list.chroot - package list
- tests/unit/secureboot_test.bats - test reference
- docs/TEST-COVERAGE.md - documentation
- docs/PRD.md - requirements documentation

Reference: Security audit FINDING-007 (test coverage)

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

tests/unit/secureboot_test.bats

@@ -247,8 +247,8 @@
     grep -q "efitools" /workspace/config/package-lists/knel-football.list.chroot
 }
 
-@test "package list includes sbsigntools" {
-    grep -q "sbsigntools" /workspace/config/package-lists/knel-football.list.chroot
+@test "package list includes sbsigntool" {
+    grep -q "sbsigntool" /workspace/config/package-lists/knel-football.list.chroot
 }
 
 @test "package list includes systemd-boot" {