enhancement(factory-health): orphan-branch commit recipe should explicitly use 'git commit -S' for signing

## Summary

The `/vsdd-factory:factory-health` skill's orphan-branch creation step uses:

```bash
git commit --allow-empty -m "chore: initialize factory-artifacts orphan branch"
```

Whether this commit is signed depends entirely on the operator's `git config commit.gpgsign`. In environments that enforce signed commits via repo policy, CI, branch protection, or organizational mandates (e.g., the user's global `~/.claude/CLAUDE.md` in this case requires SSH-signed commits with no exceptions), this is fragile:

- If the operator's config has `commit.gpgsign = false` (or unset), the initial orphan commit is unsigned and a downstream sign-verification check fails.
- If the operator's GPG/SSH signing key is misconfigured, the failure mode is silent under the current invocation.
- In CI / containers / fresh dev environments, the gitconfig may not have signing set up at all.

## Proposed change

Explicit `-S`:

```bash
git commit --allow-empty -S -m "chore: initialize factory-artifacts orphan branch"
```

This guarantees signing regardless of user config. If signing infrastructure is missing, the commit fails loudly (which is the correct outcome — don't silently produce unsigned artifacts in a project that requires signed commits).

## Applies to

- `skills/factory-health/SKILL.md` — orphan branch creation step
- Any other skill that generates commits programmatically (state-manager phase commits, etc. — worth a sweep)

## Acceptance criteria

- [ ] `/vsdd-factory:factory-health` uses `git commit -S` explicitly.
- [ ] If signing is misconfigured, the skill fails with a clear error message pointing at the underlying signing issue.
- [ ] Sweep / audit of other skills that produce commits → all use `-S`.

## Found during

`/vsdd-factory:factory-health` on `switchboard-blue` (2026-06-23, `vsdd-factory@1.0.0-rc.21`). Project rules (`CLAUDE.md`) require SSH-signed commits with no `--no-gpg-sign` allowed. Local gitconfig had `commit.gpgsign=true` so this worked accidentally, but the recipe doesn't depend on that — and shouldn't.

## Notes

This is a small / good-first-issue change.