Never sign byre's own commits on the server

internal/agents/kb/signing.md

@@ -2,7 +2,7 @@ How byre signs merge commits on the merging user's Mac, and how to turn it on fo
 
 # Signing merge commits
 
-byre never signs with a key on the machine it runs on. When a project checkout has `commit.gpgsign` true, the squash commit of a Merge or `merge_to_main` is signed on the merging user's most recently active connected Mac, so a key that never leaves that Mac (a Secure Enclave key behind Touch ID, say) works. The merge fails when that user has no app connected.
+byre never signs with a key on the machine it runs on: its own end-of-turn and snapshot commits there are always unsigned. When a project checkout (or the server's global config) has `commit.gpgsign` true, the squash commit of a Merge or `merge_to_main` is signed on the merging user's most recently active connected Mac, so a key that never leaves that Mac (a Secure Enclave key behind Touch ID, say) works. The merge fails when that user has no app connected.
 
 ## Turning it on
 
@@ -12,7 +12,7 @@ Run, on the machine byre runs on:
 byre signing <checkout>
 ```
 
-`<checkout>` is the project's main checkout, not a task worktree. It sets `commit.gpgsign` true for the checkout and false for its task worktrees (which would otherwise try to sign on the server and fail), prints both values, and fails unless the checkout's reads true. It refuses a checkout that is itself a linked worktree. No restart is needed; the next merge reads the config.
+`<checkout>` is the project's main checkout. It sets `commit.gpgsign` true for the checkout, prints it, and fails unless it reads true. No restart is needed; the next merge reads the config.
 
 ## What the Mac needs
 

internal/git/git.go

@@ -384,7 +384,11 @@ func runNetwork(ctx context.Context, dir string, args ...string) (string, string
 }
 
 func runCodeInput(ctx context.Context, dir string, env []string, stdin io.Reader, args ...string) (string, string, int, error) {
-	cmd := procgroup.CommandContext(ctx, "git", args...)
+	argv := args
+	if args[0] != "config" {
+		argv = append([]string{"-c", "commit.gpgsign=false"}, args...)
+	}
+	cmd := procgroup.CommandContext(ctx, "git", argv...)
 	cmd.Dir = dir
 	cmd.Env = append(os.Environ(), env...)
 	cmd.Stdin = stdin