fix(ci): skip merge commits in Verify Commit Signatures (lockdown)

The verify-signatures job in lockdown.yml iterates
`git log origin/main..HEAD` to enforce signatures on every commit.
On a pull_request event, GitHub checks out `refs/pull/N/merge` — a
simulated merge commit that is auto-generated and not GPG-signed —
which the loop then flagged as an unsigned human commit.

Surfaced on PR #89, where my (signed) ureq migration commit passed
verification but the auto-merge commit `63b97bc…` triggered:

    ERROR: Unsigned commit detected: 63b97bc…
    All human commits MUST be GPG or SSH signed.

Adding `--no-merges` to both `git log` invocations restricts the
check to real human commits only. The auto-merge commit's parents
(both real commits) are still checked.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/lockdown.yml

@@ -39,7 +39,13 @@ jobs:
           # Trusted bot accounts that don't require signatures
           TRUSTED_BOTS="noreply@anthropic.com github-actions[bot] dependabot[bot]"
 
-          for commit in $(git log --format=%H origin/main..HEAD 2>/dev/null || git log --format=%H -10); do
+          # On a pull_request event, GitHub checks out the simulated
+          # merge commit `refs/pull/N/merge`, which is auto-generated
+          # and not GPG-signed. Skip merge commits (`--no-merges`) so
+          # only real human commits are verified. This was missing the
+          # auto-merge case and rejected every PR on the first push
+          # (saw on PR #89, 2026-05-25).
+          for commit in $(git log --no-merges --format=%H origin/main..HEAD 2>/dev/null || git log --no-merges --format=%H -10); do
             AUTHOR_EMAIL=$(git log -1 --format='%ae' "$commit")
             AUTHOR_NAME=$(git log -1 --format='%an' "$commit")