`base-build-scratch` gains a `signing_key_var` input: `.mok-material`'s "vars" mode now decodes whichever CI/CD variable the consumer names, rather than always `MOK_SIGNING_KEY_B64`. cairn/base can point kmod signing at `UKI_SIGNING_KEY_B64` -- the same key that signs the sealed UKI -- and sign kmods with it instead of minting a separate MOK. The name is read indirectly and validated first (empty or any character outside `A-Z0-9_` is fatal); there is no fallback to `MOK_SIGNING_KEY_B64` once a consumer names a different variable. `mok-fail-closed`'s negative control grows from three cases to six: the two existing (unset -> red naming the variable, set -> green) now pass `SIGNING_KEY_VAR=MOK_SIGNING_KEY_B64` explicitly, plus two new cases proving `signing_key_var=UKI_SIGNING_KEY_B64` goes green when only that variable carries the key, and stays red naming `UKI_SIGNING_KEY_B64` -- never falling back to `MOK_SIGNING_KEY_B64` -- when only the old variable is set, and one more proving the name guard rejects an injected name and a positional-parameter name before the indirect read, without running the injection. A new assertion parses the template and checks `signing_key_var`'s default and that `build-base`, `kmod-zfs`, and `kmod-nvidia` all wire `SIGNING_KEY_VAR` from the input. Additive, backward compatible, default unchanged (`MOK_SIGNING_KEY_B64`). Minor bump. - `base-build-scratch` input `signing_key_var` (default `MOK_SIGNING_KEY_B64`, regex `^[A-Z_][A-Z0-9_]*$`). Wired into `build-base`, `kmod-zfs`, and `kmod-nvidia` as `SIGNING_KEY_VAR`.