Function build_repo_key_refresh_bundle 

pub fn build_repo_key_refresh_bundle(
    repos: &ReposConfFile,
    selected_section: &str,
) -> Result<RepoApplyBundle, String>

What: Plan privileged pacman-key receive + local sign for the selected repo row only.

Inputs:

• repos: Parsed repos.conf document.
• selected_section: Pacman [repo] name from the modal (case-insensitive trim).

Output:

• RepoApplyBundle with two commands (recv, lsign) or an error string.

Details:

• Requires key_id with at least 8 hex digits after normalization; optional key_server is passed to pacman-key --recv-keys the same way as full apply.
• Does not write drop-ins or run pacman -Sy.

Errors

• When active_tool returns an error (no privilege tool configured).
• When no matching [[repo]] row exists, key_id is missing/invalid, or fingerprint normalization fails.