fix(release): per-clone committer identity; signing opt-in

The fresh release clone in the orchestrator container has no git
identity, so the release commit refused with 'Author identity unknown'
— and the unconditional -S would have failed next on the keyless
container. commit_and_push now sets a configurable bot identity on the
clone and signs only when ROBOCO_RELEASE_SIGN_COMMITS is armed with a
mounted key.

tests/unit/services/test_release_executor.py

@@ -520,10 +520,12 @@ async def test_release_push_argv_uses_extraheader_not_url_token(
     git_prefix = ["-c", f"http.extraheader=Authorization: Basic {expected_basic}"]
     captured: list[list[str]] = []
 
-    # commit_and_push issues: add -A, commit -S -m, rev-parse HEAD, push.
+    # commit_and_push issues: add -A, 2x identity config, commit, rev-parse, push.
     responses = iter(
         [
             _DoneProc(b""),  # add -A
+            _DoneProc(b""),  # config user.name
+            _DoneProc(b""),  # config user.email
             _DoneProc(b""),  # commit
             _DoneProc(b"deadbeef\n"),  # rev-parse HEAD
             _DoneProc(b"ok"),  # push

tests/unit/services/test_release_executor_commit_fail_closed.py

@@ -50,8 +50,9 @@ async def test_commit_failure_aborts_before_push() -> None:
     """A failed ``git commit`` must raise — never push the pre-bump base."""
     ops = _FakeGitOps(
         _ctx(),
-        # add ok, commit FAILS (rc=1, e.g. gpgsign/pre-commit reject).
-        script=[(0, ""), (1, "error: gpg failed to sign the data")],
+        # add ok, 2x identity config ok, commit FAILS (rc=1, e.g.
+        # gpgsign/pre-commit reject).
+        script=[(0, ""), (0, ""), (0, ""), (1, "error: gpg failed to sign the data")],
     )
     with pytest.raises(RuntimeError, match="commit"):
         await ops.commit_and_push("0.13.0")
@@ -75,11 +76,13 @@ async def test_green_commit_then_push_returns_sha() -> None:
     """Happy path: add ok, commit ok, rev-parse sha, push ok → returns the sha."""
     ops = _FakeGitOps(
         _ctx(),
-        script=[(0, ""), (0, ""), (0, "deadbeef\n"), (0, "ok")],
+        script=[(0, ""), (0, ""), (0, ""), (0, ""), (0, "deadbeef\n"), (0, "ok")],
     )
     sha = await ops.commit_and_push("0.13.0")
     assert sha == "deadbeef"
     assert ops.calls[0][:1] == ("add",)
-    assert ops.calls[1][:1] == ("commit",)
-    assert ops.calls[2][:1] == ("rev-parse",)
-    assert ops.calls[3][:1] == ("push",)
+    assert ops.calls[1][:1] == ("config",)
+    assert ops.calls[2][:1] == ("config",)
+    assert ops.calls[3][:1] == ("commit",)
+    assert ops.calls[4][:1] == ("rev-parse",)
+    assert ops.calls[5][:1] == ("push",)