feat(action): trust-check/verify-signatures - Verify commit signatures

## Parent Epic
Part of #22 (Atomic Release Pipeline Actions)

## Priority
P2 - Trust validation for secure release pipelines

## Description

Create a composite action that verifies commit signatures in a range.

## Inputs

| Input | Required | Default | Description |
|-------|----------|---------|-------------|
| `commit-range` | No | `HEAD~1..HEAD` | Commit range to verify |
| `require-all` | No | `true` | Require all commits to be signed |
| `allowed-keys` | No | - | Allowed GPG key IDs (comma-separated) |
| `verify-github` | No | `true` | Accept GitHub's web-flow signature |

## Outputs

| Output | Description |
|--------|-------------|
| `all-signed` | "true" if all commits are signed |
| `signed-count` | Number of signed commits |
| `unsigned-count` | Number of unsigned commits |
| `unsigned-commits` | Comma-separated list of unsigned commit SHAs |

## Usage Example

```yaml
- uses: arustydev/gha/actions/trust-check/verify-signatures@v1
id: signatures
with:
commit-range: "origin/main..HEAD"
require-all: true

- if: steps.signatures.outputs.all-signed != 'true'
run: |
echo "Unsigned commits: ${{ steps.signatures.outputs.unsigned-commits }}"
exit 1
```

## Implementation Notes

- Uses `git verify-commit` for verification
- Handles GitHub's web-flow GPG key
- Supports allowlist of specific GPG keys
- Reports detailed results per commit

## Source Reference

`helm-charts/.github/workflows/auto-merge-integration.yaml`:
- Signature verification logic for trusted merges