fix(generator-cli): sign every local-only commit when pushing, not just HEAD

[cadesark]

Description

Linear ticket: Refs

Auth0 reported that on replay-generated PRs (e.g. auth0/auth0.net#1043) the first commit ([fern-generated] Update SDK) is unsigned while the head commit ([fern-replay] Applied customizations) is Verified.

Root cause: pushSignedCommit only recreates the branch HEAD via octokit.git.createCommit (which GitHub signs with the App key). Any earlier local commits on the branch — the [fern-generated] commit (and [fern-autoversion] when present) — are only uploaded as raw git objects via the temp ref, so they reach the remote unsigned.

Fix: sign the whole local-only commit chain:

signLocalCommitChain():
  chain = repository.getLocalOnlyCommits()   # rev-list --reverse HEAD --not --remotes=origin
  for sha in chain (oldest first):
      signed = octokit.git.createCommit(tree(sha), message(sha),
                                        parents(sha) remapped to signed predecessors)
  return signed SHA of HEAD

The branch ref is then updated to the signed head, so every commit on the PR shows as Verified. Falls back to signing HEAD only (previous behavior) when no remote-tracking refs are available or the chain exceeds a 20-commit safety cap.

Changes Made

• packages/generator-cli/src/pipeline/github/pushSignedCommit.ts: extract signLocalCommitChain — recreates every local-only commit via the GitHub API, re-parenting each onto its signed predecessor
• packages/commons/github/src/ClonedRepository.ts: add getLocalOnlyCommits(), getCommitMessage(sha), getCommitParents(sha)
• packages/generator-cli/changes/unreleased/sign-all-local-commits.yml: changelog entry (fix)
• Updated README.md generator (if applicable)

Testing

• Unit tests added/updated — new tests for multi-commit chain signing/re-parenting and empty-chain fallback; all 15 pushSignedCommit tests pass
• Manual testing completed — verified via GitHub API that ee90077 on mgmt: add Organization Roles, Connection lifecycle events, and Token Vault access grants; rename Connection attribute identifier auth0/auth0.net#1043 has verification.reason: unsigned while the replay commit is valid

Link to Devin session: https://app.devin.ai/sessions/b913483a939e40dab7e227be14eb6135
Requested by: @cadesark

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.