ci: sign the release branch with the bot GPG key

[xiaoyijun]

Summary

Mirrors the release-branch signing setup to the v2.x line, in its final form after the three rounds it took on master (#267 → #268 → #269): without it, release: 2.0.3 (#260) is unmergeable against the required-signatures ruleset, exactly like #245 was.

• Pushes to release-please--branches--** trigger a sign-release-branch job: when the head commit is unsigned (release-please commits via the REST API, which cannot sign; the Update branch (rebase) button also rewrites the commit unsigned), it amends the commit with silverhand-bot's GPG key (BOT_GPG_KEY / BOT_GPG_PASSPHRASE org secrets, same setup as logto-io/js) and force-pushes.
• All the master-line hardening is included from the start: fetch-depth: 0 (a shallow amend orphans the commit — the ci: re-sign the release branch on every push #268 incident that auto-closed release: 3.0.0-beta #245), the refuse-to-push-an-orphan guard, the skip-when-already-signed guard (no self-retriggering), and an explicit push refspec.
• The release-please job is gated to v2.x pushes; target-branch: v2.x and the unmark-latest job are untouched.
• RELEASE.md updated with the same paragraph as master.

Note: #260's branch predates this workflow, so its pushes won't trigger the job until the branch tree contains it — the first Update branch (rebase) on #260 after this merges brings the workflow in and the rebased commit gets signed automatically (the same live acceptance test as #270 on master). No rush either way: per the release ordering, #260 waits for 3.0.0 GA.

End-to-end precedent: on master this exact setup auto-signed the recreated release PR #270 (d6233ea, Verified, parent intact) with no human intervention.

Testing

• Same job, verbatim, as the one that passed its live test on master today (release: 3.0.0-beta #270 born Verified).
• v2.x-specific parts (target-branch, unmark-latest) untouched; the new job is additive.

Checklist

• .changeset (N/A — release-please)
• unit tests (N/A — workflow change)
• integration tests (N/A)
• necessary KDoc comments (N/A)

🤖 Generated with Claude Code