Gittyup commits via libgit2 directly and never invokes gpg, silently ignoring commit.gpgsign — root cause of an unsigned commit reaching main. Adds a tracked .githooks/pre-push that rejects any push carrying a commit with no signature or a bad signature, bypassable with --no-verify. Wiring core.hooksPath to it is a per-machine concern, done separately in user-dots, not shipped here.