Default Git signing to a profile-pinning wrapper, keep agent signing off the human's setup, interpolate policy placeholders, and split agent identity from secrets

Default Git signing to a profile-pinning wrapper, keep agent signing off the human's setup, interpolate policy placeholders, and split agent identity from secrets #358