Before committing, release.sh now checks whether git can sign by running
a throwaway signed commit-tree. If that fails, because there is no
user.signingkey or no agent holds the key, the script warns and makes
the release commit with --no-gpg-sign. The success message now says
whether the commit is signed or unsigned. AGENTS.md is updated to match.