fix: correct package name from sbsigntools to sbsigntool

The package name in Debian repositories is sbsigntool (singular), not
sbsigntools (plural). This typo was causing ISO builds to fail with:
  E: Unable to locate package sbsigntools

Files fixed:
- config/package-lists/knel-football.list.chroot - package list
- tests/unit/secureboot_test.bats - test reference
- docs/TEST-COVERAGE.md - documentation
- docs/PRD.md - requirements documentation

Reference: Security audit FINDING-007 (test coverage)

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

config/package-lists/knel-football.list.chroot

@@ -9,7 +9,7 @@ grub-efi-amd64-signed
 grub-efi-amd64-bin
 efibootmgr
 efitools
-sbsigntools
+sbsigntool
 systemd-boot
 systemd-boot-efi
 binutils

docs/PRD.md

@@ -386,7 +386,7 @@ The system MUST implement UEFI Secure Boot with a Unified Kernel Image (UKI) to
 **Implementation:**
 - Key generation during ISO build
 - UKI creation with systemd-boot
-- Signature with sbsigntools
+- Signature with sbsigntool
 - Key storage on ISO for user enrollment
 
 **Security Properties:**

docs/TEST-COVERAGE.md

@@ -216,7 +216,7 @@
 
 **Package Requirements**:
 - efitools in package list
-- sbsigntools in package list
+- sbsigntool in package list
 - systemd-boot in package list
 - binutils in package list
 

tests/unit/secureboot_test.bats

@@ -247,8 +247,8 @@
     grep -q "efitools" /workspace/config/package-lists/knel-football.list.chroot
 }
 
-@test "package list includes sbsigntools" {
+@test "package list includes sbsigntool" {
-    grep -q "sbsigntools" /workspace/config/package-lists/knel-football.list.chroot
+    grep -q "sbsigntool" /workspace/config/package-lists/knel-football.list.chroot
 }
 
 @test "package list includes systemd-boot" {