fix(release): per-clone committer identity; signing opt-in

The fresh release clone in the orchestrator container has no git
identity, so the release commit refused with 'Author identity unknown'
— and the unconditional -S would have failed next on the keyless
container. commit_and_push now sets a configurable bot identity on the
clone and signs only when ROBOCO_RELEASE_SIGN_COMMITS is armed with a
mounted key.

tests/unit/services/test_release_executor.py

@@ -520,10 +520,12 @@ async def test_release_push_argv_uses_extraheader_not_url_token(
     git_prefix = ["-c", f"http.extraheader=Authorization: Basic {expected_basic}"]
     captured: list[list[str]] = []
 
-    # commit_and_push issues: add -A, commit -S -m, rev-parse HEAD, push.
+    # commit_and_push issues: add -A, 2x identity config, commit, rev-parse, push.
     responses = iter(
         [
             _DoneProc(b""),  # add -A
+            _DoneProc(b""),  # config user.name
+            _DoneProc(b""),  # config user.email
             _DoneProc(b""),  # commit
             _DoneProc(b"deadbeef\n"),  # rev-parse HEAD
             _DoneProc(b"ok"),  # push