Document the signed-commits policy in CONTRIBUTE.md

[tobyhede]

CONTRIBUTE.md documents how to branch, test, format and add a changeset, but never says commits must be signed. The policy is real and already in force — every commit on main carries a signature and GitHub reports verified: true — so today a contributor learns it by having a PR pushed back, which is the worst place to find out.

What to add

A short subsection under Making Changes in CONTRIBUTE.md, between the branch step and the tests step, covering:

• The rule: every commit must be signed and show as Verified on GitHub.

• Setup, for both accepted formats — SSH is the lighter path and matches what this repo already uses:

  git config --global gpg.format ssh
  git config --global user.signingkey ~/.ssh/id_ed25519.pub
  git config --global commit.gpgsign true

  …plus the step people miss: the key must also be registered on GitHub as a signing key, not only as an authentication key. Same key, separate entry, under Settings → SSH and GPG keys.

• Verifying it worked, before opening a PR rather than after:

  git log --show-signature -1

  Note the local-verification trap while we're writing it down: with gpg.format ssh and no gpg.ssh.allowedSignersFile configured, git log --format='%G?' reports N on a commit that is signed, and GitHub still shows Verified. Checking git cat-file commit HEAD | grep gpgsig, or the PR's commit list, gives the honest answer.

• Fixing an unsigned branch that has already been pushed:

  git rebase --exec 'git commit --amend --no-edit -S' main

Also worth deciding

• Whether to enforce it in branch protection (Settings → Branches → Require signed commits). Documenting a rule nothing enforces is how it drifts; enforcing it without documenting it first is how contributors get blocked with no explanation. Doing them in that order — note first, then the setting — is the point of filing this now.
• Whether Dependabot and other bots are exempt. Their commits are signed by GitHub's own key, so they satisfy the rule today, but the note should say so rather than leave a reader guessing about the dependabot[bot] commits they see on main.

Done when

• CONTRIBUTE.md states the signing requirement, with SSH and GPG setup and the GitHub signing-key registration step
• It shows how to verify a commit is signed, and how to repair a branch that is not
• Bot commits are addressed explicitly
• A decision is recorded on whether Require signed commits gets turned on for main

No code change and no changeset — CONTRIBUTE.md is not shipped in any published tarball.