feat(verify): add verify_commits.sh, allowed_signers and reusable verify.yml 🔑

[glokos]

• verify_commits.sh enforces ssh signatures from enrolled hardware-backed sk- keys on every human commit
• allowed_signers is the canonical enrollment registry
• verify.yml self-checks-out via job.workflow_repository at job.workflow_sha, pinning script and allowlist to the caller's ref
• self-verify.yml runs the check on this repo's own prs
• codeowners requires devops review on every change

[linear-code]

DEV-120 Move commit-signature verification into a dedicated commit-signing repo

Host the commit-signature verification in its own dedicated public repo, not the generic reusable-workflows repo (DEV-183), per Anuj's recommendation (Slack thread linked). The repo is the canonical home of the allowed_signers list and the reusable verify workflow.

Repo structure:

cowprotocol/commit-signing/     (public repo)
├── .github/workflows/
│   ├── verify.yml          # reusable workflow other repos call
│   └── self-verify.yml     # checks this repo's own PRs
├── verify_commits.sh       # from infra PR #6272
├── allowed_signers         # the canonical list
├── CODEOWNERS
└── README.md

Enforcement: roll out org-wide via GitHub's organization-wide required workflows feature, so repos consume one maintained implementation and cannot opt out.

Related: DEV-155 (commit signing v2, source of the verify script), DEV-183 (generic reusable-workflows repo, deliberately kept separate), DEV-199 (bot key in allowed_signers).

Review in Linear

[github-actions]

🌈 zizmor

✅ No findings in GitHub Actions workflows.