ci: sign automated release-update commits (#183)

## What

Add `sign-commits: true` to the `peter-evans/create-pull-request` step
in `.github/workflows/update-releases.yml`.

## Why

The workflow currently commits via the action's default local-git path,
which produces **unsigned** commits. Branch protection on `main`
requires *"commits must have verified signatures"*, so the automated PRs
it opens (e.g. #182) cannot be merged:

```
committer: github-actions[bot]
verified:  false
reason:    unsigned
```

With `sign-commits: true`, `create-pull-request` builds the commit
through the GitHub git-data API. Commits created via the API with
`GITHUB_TOKEN` are signed server-side by GitHub and show as **Verified**
(attributed to `github-actions[bot]`), satisfying the requirement. No
key management needed.

## Notes

- Committer identity on generated commits becomes `github-actions[bot]`
rather than the local git config — expected with API-created commits.
- Applies to future runs. The already-open #182 can be regenerated by
re-dispatching this workflow once merged (fixed branch name +
`delete-branch: true` updates the PR in place).

Refs #168.

---------

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

Author: TerryHowe

.github/workflows/update-releases.yml

@@ -68,15 +68,21 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           branch: automated/update-releases
           delete-branch: true
+          sign-commits: true
           commit-message: 'chore: update releases.json for ${{ steps.update.outputs.ADDED_VERSIONS }}'
           title: 'chore: update releases.json for ${{ steps.update.outputs.ADDED_VERSIONS }}'
           body: |
-            Automated update for new ORAS release(s): `${{ steps.update.outputs.ADDED_VERSIONS }}`.
+            Automated update adding ORAS release(s) `${{ steps.update.outputs.ADDED_VERSIONS }}`
+            to `src/lib/data/releases.json`, with `dist/` rebuilt to match.
 
-            Generated by `.github/workflows/update-releases.yml` using
-            `.github/scripts/update-releases.mjs`. Please verify the appended
-            entries in `src/lib/data/releases.json` and the rebuilt `dist/`
-            before merging.
+            Generated by `.github/workflows/update-releases.yml` via
+            `.github/scripts/update-releases.mjs`.
+
+            Review checklist:
+            - Checksums match the upstream release(s) at
+              https://github.com/oras-project/oras/releases (the one thing not
+              covered by CI)
+            - `check-dist` is green — confirms `dist/` matches the rebuilt source
 
             Refs #168.
           signoff: true