[zbeekman]

Summary

Fixes #30. The Clang MPI TAU configurations
(clang-mpi-pthread-pdt, depthlimit-clang-mpi-pthread-pdt,
param-clang-mpi-pthread-pdt) did not install completely. They have
been broken since the switch to MPICH in 785f806 (v1.4.0), so
1.4, 1.5, 1.6, and 1.7 are all affected. 1.3 (Open MPI) is not.

Also pins the new GitHub CLI apt signing key.

Cause

• Debian's mpifort -show adds gfortran compile flags
  (-fallow-invalid-boz, -fstack-protector-strong,
  -fstack-clash-protection, -fcf-protection).
• TAU's configure copies them into TAU_MPI_FLIB. clang++ rejects
  -fallow-invalid-boz when it links libTAUsh-*.so, so
  make install stops before it installs libTauPthreadWrap.a.
  flang also rejects the three hardening flags when tau_f90.sh
  links.
• installtau exits 0 when make install fails, so the image build
  did not fail.
• TAU takes FULL_CC/FULL_CXX from mpicc -show, so the Clang MPI
  configurations compiled user code with gcc/g++.

Changes

• Dockerfile: strip the four flags in TAU's configure before
  installtau. A grep -q fails the build if TAU changes that line.
• Dockerfile: run the Clang MPI installtau with
  MPICH_CC=clang MPICH_CXX=clang++ MPICH_FC=flang.
• Dockerfile: fail the build if any Makefile.tau-* has no
  static-*/libTauPthreadWrap.a.
• Dockerfile.devtools: pin 7F38BBB59D064DBCB3D84D725612B36462313325.
  GitHub rotated keys; 2C61...6059 expired 2026-09-04, and the apt
  repo InRelease is now signed by the new key. Both fingerprints are
  listed in cli/cli docs/install_linux.md.

Testing

In a ghcr.io/paratoolsinc/salt-dev:1.7 container, with TAU master
at 2e647c6, I ran the Clang MPI installtau with the patch:

• All 8 TAU configurations have libTauPthreadWrap.a.
• For each Clang MPI configuration, tau_cc.sh (C) and tau_f90.sh
  (Fortran with mpif.h) build an MPI hello program with
  clang/flang. Each program runs on 2 ranks and writes 2 profiles.
• The GCC MPI configuration, with the four flags removed from its
  Makefile, builds and runs C and Fortran (use mpi) programs.
• lint.sh checks pass (hadolint v2.14.0, as in CI), and
  test-build-llvm.sh passes.

I did not do a full image build. CI builds the image.

Not fixed

• use mpi with flang: Debian's mpi.mod is in gfortran format.