Make Renovate commits carry the sign-off the gate requires

Renovate MRs could not merge. The commit-trailers check, which has required a sign-off on every commit since 63b74e2c, failed on Renovate's commits because they carried no Signed-off-by: trailer.

This extends the :gitSignOff preset and sets gitAuthor to the identity Renovate already commits as, so the trailer names the bot. The check itself is unchanged.

Two of the open Renovate MRs (just, uv) also fail the CI download check because a version bump does not carry its sha256. No datasource supplies that hash for a GitHub release asset, so docs/maintenance.md now says to add it from the release's checksum asset.