Add commit signing detection to setup skill

[sebastientaggart]

Add a new Phase 2 (commit signing) to the setup skill. When a project requires signed commits, /setup now detects existing signing configuration, asks the user if signing is needed, verifies a signing key exists, and enables commit.gpgsign and tag.gpgsign at the repo level. This avoids token-wasting recovery loops when agents create unsigned commits that get rejected by branch protection.

The change is purely at the git config layer — no new config placeholders or skill template conditionals needed. All skills that create commits or tags benefit automatically.

Issue #143

[sebastientaggart]

Review Summary

Verdict: APPROVE

Findings

• [WARNING] Phase 2 enables commit.gpgsign and tag.gpgsign via git config without an explicit confirmation gate before writing, yet other phases require a "Proceed? (yes/no)" prompt before every write. The user says "yes" to wanting signed commits, and the skill immediately runs git config commit.gpgsign true — consider adding a confirmation step showing the exact config changes before applying them, consistent with the Phase 3/4 pattern.
• [WARNING] The hard-rules section says "Do not skip any human gate in Phase 3 or Phase 4" but Phase 2 (commit signing) also performs writes to git config, so it should arguably be included in that guardrail sentence for completeness.
• [NOTE] The git config --get commit.gpgsign check only returns true as a string; if the value is set to yes (which git also interprets as truthy), the phase would not detect it as enabled and would re-prompt the user. Using git config --bool --get commit.gpgsign would normalize any truthy value to the string true.
• [NOTE] All five adapter outputs (skills/, .agents/, .claude/, .cursor/, .gemini/) and the docs page carry identical phase content and consistent phase-number renumbering — sync looks correct.

[sebastientaggart]

Review Summary

Verdict: APPROVE

Findings

• [NOTE] The git config write commands in Phase 2 do not specify --local explicitly; they rely on git's default (which is local). This is correct behavior, but adding --local would make the intent self-documenting and guard against future GIT_CONFIG_GLOBAL edge cases. Non-blocking.

No blocking issues found. The new Phase 2 (commit signing) is well-structured: it checks existing config before prompting, has confirmation gates on every write, handles both the "key exists" and "no key found" branches with appropriate user interaction, and provides an escape hatch to external docs. Phase renumbering (2-4 becomes 3-5) is applied consistently across all six adapter files, including cross-references in the label population note (DEFAULT_MILESTONE in Phase 4) and the skip-to targets. Hard rules correctly expand the file-modification scope to include local git config and extend the human-gate requirement to cover the new phase range.