feat: evaluate signed commits ruleset

[jflowers]

Context

The governance scan (2026-08-21) found 0 of 6 protected repositories require signed commits. Neither zero-dot-force nor complytime enforce this today.

Action

Evaluate whether to add a required_signatures rule to the safe-settings rulesets. This would require all commits to the default branch to be signed (GPG, SSH, or S/MIME).

Considerations:

• Pro: Stronger supply-chain integrity, commit non-repudiation
• Con: Friction for contributors who don't have signing configured, may break squash-merge if GitHub's merge commit isn't signed
• GitHub's newer rulesets support required_signatures as a rule type

If approved, add to safe-settings/settings.yml:

    rules:
      # ... existing rules ...
      - type: required_signatures

Acceptance Criteria

• Team decision documented (enable or defer)
• If enabled: ruleset updated and applied via safe-settings sync