Add pull request signature checks

[kwisatzh]

Summary

• Add a read-only pull-request check that requires GitHub-verified signatures on every commit, including bot and merge commits.
• List every unverified commit and fail if the API cannot provide a complete, stable commit list.
• Document SSH signing setup and how contributors can confirm verification.

No repository rulesets are changed. Maintainers can select commit-signatures as a required status check after its first hosted run.

Validation

• 26 local behavior cases passed for this workflow, including unsigned commits, missing verification, stale PR state, pagination and API errors.
• Workflow lint and whitespace checks passed.
• The same checker rejected unsigned contributor commits when exercised against the live PR API.
• Only the workflow and contribution guide are included.