feat(git): pick the Git signing key based on isWork

[DevSecNinja]

Why

On work machines, Git commits were being signed with the personal SSH key. gitSigningKey shipped a single hardcoded default in .chezmoi.yaml.tmpl, so every machine got the same key unless it was overridden by hand in a local chezmoi config.

What changed

Two defaults now ship: a personal key (unchanged) and a work key. The pick is driven by the isWork flag that already exists in the config template, derived from dsregcmd /status reporting an Entra ID tenant name ending in Microsoft.

Two details worth a look:

• The selection moved down the template. gitSigningKey used to be resolved above the Entra ID detection block, so isWork was not yet known at that point. The variable is now initialised early (to keep the override check next to its documentation) and the default is chosen after detection runs.
• A persisted shipped default is re-evaluated, not treated as an override. My local ~/.config/chezmoi/chezmoi.yaml already carries gitSigningKey: "<personal key>" from an earlier chezmoi init, so a plain "only fall back when empty" rule would have pinned the wrong key forever. A value that still equals either shipped default is re-picked; only a genuinely custom key wins.

Docs updated in docs/git-signing.md and docs/chezmoi-variables.md.

Testing

Three new cases in tests/bash/op-shell-plugins.bats (work, non-work, stale-persisted-default) using a fake wslinfo + dsregcmd.exe on PATH, so they are deterministic regardless of the host running them. Full file passes (37 tests). validate-chezmoi.bats passes.

Verified by hand on a work machine: isWork: true renders signingkey = key::ssh-ed25519 AAAA...NHf9KPQ... in ~/.config/git/config.

Notes for the reviewer

• Picking up the new key locally requires re-running chezmoi init (config data is only regenerated then) followed by chezmoi apply.
• The commit on this branch is unsigned: the 1Password SSH agent had no identities available at the time (ssh-add -l empty), so signing failed for both keys. Happy to amend with a signed commit if that matters for this repo.