Support verified GitHub App commit signatures

[sentry-junior]

Junior publishes bot commits that GitHub does not mark as Verified.

Current behavior

• Sandbox git prep forces commit.gpgsign=false (packages/junior-github/src/plugin.ts).
• Author/committer are set to the GitHub App bot; human actors are credited with Co-Authored-By trailers.
• Branches update over git smart HTTP (git push); REST Git database and ref writes are denied on purpose (packages/junior-github/SETUP.md).
• Result: App-attributed commits without a GitHub Verified badge.

Gap

• Repos/orgs that require verified commits, or reviewers who rely on the Verified badge, cannot treat Junior commits as signature-verified.
• GitHub’s bot verification path expects commits created through authenticated App commit APIs without custom author/committer/signature fields (commit signature verification). Local gpg/ssh signing plus git push is not that model and is awkward for App bots.

Impact

• Blocks Junior from meeting verified-commit branch protection / policy requirements.
• Weakens trust signals on bot-authored PR commits even when identity and co-author trailers are correct.

Requested by michael.

--

View Junior Session [Sentry]