chore(ci): add GPG commit signing to weekly-update workflow

[jdalton]

Add setup-git-signing/cleanup-git-signing actions and structured /updating prompt.

---

Note

Medium Risk
Moderate risk because it changes the CI automation that creates and pushes dependency update commits/PRs and introduces a new required secret (BOT_GPG_PRIVATE_KEY) that can break the workflow if misconfigured.

Overview
Adds GPG commit signing to the weekly-update.yml automation by running setup-git-signing after creating the update branch and ensuring cleanup via cleanup-git-signing on completion.

Replaces the inline Claude /updating command string with a structured heredoc prompt that explicitly defines context, instructions (atomic conventional commits, no pushing/PR creation by Claude), and success criteria for dependency updates.

^{Reviewed by Cursor Bugbot for commit cf2bf7f. Configure here.}