docs: document commit-signing requirement in CONTRIBUTING.md

[baraiz]

Closes #39

Added a "Commit signing" subsection to the Pull request process section
explaining how to set up GPG signing locally and register the key on GitHub.

[KTS-o7]

Thanks for the docs addition. A few issues that need fixing before this can merge:

Blocker — broken markdown. The new \``bashblock on thegpg --full-generate-keysnippet is **missing its closing fence**. The diff adds 19 lines and zero of them is```to close the block. As soon as this lands, the rendered page will eat the existing block at lines 134–137 (thegit config commit.gpgsign truesnippet under 5.1) and continue consuming everything afterward as code. Add a closing```after thegpg --armor --export` line.

Structural duplication. There's already a 5.1. Sign your commits. section at line 129 that covers GPG + SSH signing setup (git config, key upload, GitHub settings). The PR adds a ### Commit signing block immediately before it — so the reader sees two adjacent sections on the same topic. Either replace 5.1 with this new content, or fold the SSH setup into 5.1 and drop the duplicate.

Heading hierarchy. The new ### Commit signing is inserted between section 5 (Push and open a PR) and its child 5.1. The hierarchy becomes 5 → ### Commit signing → 5.1, which is wrong — 5.1 is supposed to be a child of 5. If 5.1 stays, the new section belongs at the top level (e.g. just before item 5) or restructured as sub-items.

SSH signing missing. The intro says "GPG or SSH-signed commits" but the body only documents GPG. SSH signing is the modern default for most contributors and would be a one-paragraph addition (configure an SSH key in git config gpg.format ssh, add to GitHub, done).

Minor. No mention of how to verify a signature locally (git log --show-signature) or what to do if GitHub reports unknown_key on a commit you know you signed.

Not mergeable in current form — the missing fence is the priority fix.