signing-preflight — find the locked key before the first commit, not after the hundredth

On real projects: an agent committed unsigned without asking to unlock the key; a signing call on a locked SSH key hung the session; 121 commits had to be re-signed after the fact — and the key turned out to have no passphrase at all. Each was a two-second question at the start of the session.

Check (read-only, bounded)

git config --get commit.gpgsign          # true → signing is expected
git config --get gpg.format              # ssh | openpgp (empty = openpgp)
git config --get user.signingkey

SSH signing — does a test signature finish? (user.signingkey may be a key file or a literal key::ssh-…; the test signature is the check that works for both.)