Moves org minisign release signing off per-repo bash scripts onto the
shared Go tool, with tests that exercise pubkey mismatch.

Co-authored-by: Cursor <cursoragent@cursor.com>