feat: add gpg signing key bootstrap script

[cwaits6]

Adds scripts/gpg-signing-key/ — generates a fresh RSA-4096 GPG key, registers the public half with GitHub via the API, and repoints global git signing at it.

Written after an expired signing key turned into a multi-step manual cleanup (extend expiry, re-export, delete and re-add on each forge, update every consumer). This collapses the new-key path into one prompted run.

Behavior

• Preflights gpg/git/gh/jq and the admin:gpg_key scope, exiting before any change if either is missing
• Prompts for name, email, comment, expiry, passphrase, and GitHub key title; name/email default from existing git config
• Generates RSA-4096 primary (sign + certify) plus RSA-4096 encryption subkey
• Uploads the armored public key, then optionally prunes stale GPG entries on the account
• Backs up ~/.gitconfig to a timestamped copy before writing signing config
• Verifies with a real test signature

Notes

• Aborts before touching git config if the upload fails, so the local config never points at a key GitHub does not have
• Passphrase is optional; when set it lands in a mktemp params file that is shredded on exit
• bash -n clean