Sign codeflow commits from PCS and verify them before auto-approval

[Copilot]

Code flow PRs were previously treated as trustworthy based on commit author identity, which is easy to spoof. This change makes PCS-produced code flow commits cryptographically attributable to the service and requires those signatures to verify before the PR can be auto-approved.

• Overview

  • Adds a commit-signing abstraction in DarcLib so darc continues to create unsigned commits while PCS can opt into signing.
  • Wires PCS to a service-side signer that loads a GPG private key from Key Vault and applies it to forward-flow and back-flow commits when configured.
  • Replaces the previous author-name approval gate with local signature verification against the PR branch before auto-approving the pull request.

• Security impact

  • Auto-approval now depends on cryptographic verification of every commit in the PR, rather than a spoofable author string.
  • The signing path is scoped to PCS only, so darc-driven workflows remain unchanged.

[adamzip]

@dkurepa PRUpdater is starting to have quite a huge number of dependencies, it could be good to try to keep it down if possible. There's 3-4 new dependencies that have to do with auto approvals. Maybe one of those services can be the "orchestrator" for the auto approval processor, like IPullRequestApprover, and that it would contain all the entry-points to the verification, approval, and signing methods that are needed in PullRequestUpdater. That could offload some of the weight off of PrUpdater

[dkurepa]

I'll keep that in mind.
Please don't waste time looking at this PR yet, it's just a draft made by the agent