fix(build): explicitly add --nosign when building a srcpkg

We should explicitly instruct makepkg to not sign the source package,
even when the BUILDENV array in makepkg.conf contains 'sign'. The
devtools workflow is to always sign separately from building, which is
different from makepkg and it should not depend on its configuration.

Furthermore, this function is currently used only in offload-build to
collect sources that are transferred to the server before the build
itself. Signing this source package does not provide any benefits.

src/lib/util/makepkg.sh

@@ -28,7 +28,9 @@ makepkg_source_package() {
 		export LIBMAKEPKG_SRCINFO_SH=1
 		write_srcinfo() { print_srcinfo; }
 
-		set +e -- -F --source
+		# explicitly instruct makepkg to not sign the source package, even when
+		# the BUILDENV array in makepkg.conf contains 'sign'
+		set +e -- -F --source --nosign
 		# shellcheck source=/usr/bin/makepkg
 		source "$(command -v makepkg)"
 	)