Cloud/remote sessions push unsigned commits, blocking repos that require signed commits

Related to #7711 (closed "not planned") — reopening the underlying problem because it's a hard blocker, not a nice-to-have, for any org whose branch protection requires signed commits (a common, non-exotic policy).

What happened: a Claude Code cloud/remote session authored a commit and pushed it to a PR branch. The commit was unsigned (verification.reason: "unsigned" via the GitHub API). The repo's branch protection ruleset requires signed commits, so the PR sat mergeStateStatus: BLOCKED with every other check green. Had to manually re-sign the commit from a machine with real signing config and force-push to unblock it.

Why this isn't a "seed a key" ask: shipping a real private signing key into an ephemeral, third-party-adjacent cloud VM has its own security cost, and that tradeoff shouldn't be pushed onto users.

What other agent platforms do instead: Cursor's cloud agents sign commits server-side with a platform-managed key (HSM-backed), so commits show "Verified" automatically with zero local setup. This is the same pattern GitHub Actions uses for its own bot commits — created via the REST API using the app's token, signed and verified by GitHub itself, no local GPG/SSH key involved anywhere.

Ask: have Claude Code cloud sessions create commits the same way — via the GitHub App identity / API — so they're verified server-side, instead of via raw git push from the ephemeral VM. This would make Claude Code cloud sessions usable in any repo that requires signed commits, which today they effectively aren't.