docs: add Signed commits section to CONTRIBUTING (#66)

Adds a **Signed commits** section to this repo's CONTRIBUTING, per owner
ruling **D218**. The estate policy is
[`docs/SIGNING-POLICY.adoc`](https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc)
in hyperpolymath/standards.

This repo's default branch is covered by the zero-bypass
`Require-Signed-Commits` ruleset, and rebase-merge is off. The section
tells contributors what that requires:

- People and interactive agents sign with an SSH signing key.
- Apps, bots and workflows write through the API, so GitHub signs their
commits.
- PRs are merged with squash.

If the file already had its own signing section, that section is
replaced in place instead of adding a second one. Lines elsewhere that
told people to sign with GPG are changed to match the policy (SSH for
people).

This is a docs-only change. The commit was created through
`createCommitOnBranch`, so GitHub signs it.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: hyperpolymath

.github/CONTRIBUTING.md

@@ -123,3 +123,20 @@ We follow [Conventional Commits](https://www.conventionalcommits.org/):
 [optional body]
 
 [optional footer]
+
+## Signed commits
+
+Every commit that reaches the default branch must be signed; a ruleset refuses
+unsigned pushes. Estate policy:
+[SIGNING-POLICY](https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc).
+
+- **People and interactive agents** sign with an SSH key registered on GitHub
+  as a *signing* key (`gpg.format=ssh`, `user.signingkey=<key>.pub`,
+  `commit.gpgsign=true`). The committer email must be verified on that account.
+- **Apps, bots and workflows** never `git push` local commits. They write
+  through the API (`createCommitOnBranch` or the estate `signed-push` action)
+  so that GitHub signs each commit.
+- Merge PRs with **squash**. The ruleset checks every commit on the PR branch,
+  not just the result, so one unsigned commit blocks the merge. Re-create such a
+  branch with signed commits (`git cherry-pick -S`) and open a new PR.
+  Rebase-merge replays commits unsigned and is disabled.

CONTRIBUTING.adoc

@@ -7,3 +7,20 @@
 . Submit a pull request
 
 *Author:* Jonathan D.A. Jewell j.d.a.jewell@open.ac.uk
+
+== Signed commits
+
+Every commit that reaches the default branch must be signed; a ruleset refuses
+unsigned pushes. Estate policy:
+https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc[SIGNING-POLICY].
+
+* **People and interactive agents** sign with an SSH key registered on GitHub
+  as a *signing* key (`gpg.format=ssh`, `user.signingkey=<key>.pub`,
+  `commit.gpgsign=true`). The committer email must be verified on that account.
+* **Apps, bots and workflows** never `git push` local commits. They write
+  through the API (`createCommitOnBranch` or the estate `signed-push` action)
+  so that GitHub signs each commit.
+* Merge PRs with **squash**. The ruleset checks every commit on the PR branch,
+  not just the result, so one unsigned commit blocks the merge. Re-create such a
+  branch with signed commits (`git cherry-pick -S`) and open a new PR.
+  Rebase-merge replays commits unsigned and is disabled.