docs: require signed commits in contributor docs

.github/pull_request_template.md

@@ -9,6 +9,7 @@
 ## :pencil: Checklist
 <!--- Put an `x` in the boxes that apply -->
 
+- [ ] All commits are signed (see [Commit signing](https://github.com/PostHog/posthog-unity/blob/main/CONTRIBUTING.md#commit-signing))
 - [ ] I reviewed the submitted code.
 - [ ] I added tests to verify the changes.
 - [ ] I updated the docs if needed.

AGENTS.md

@@ -1,6 +1,7 @@
 # Agent Instructions
 
 - Read and follow [CONTRIBUTING.md](./CONTRIBUTING.md) before contributing to the SDK.
+- Sign every commit; `main` rejects unsigned commits. Configure signing in the git config you commit with, as described in "Commit signing" in [CONTRIBUTING.md](./CONTRIBUTING.md).
 - Read and follow [RELEASING.md](./RELEASING.md) when adding changesets or working on publishing.
 - Public API changes: follow "Public API changes" in [CONTRIBUTING.md](./CONTRIBUTING.md). As an agent, also:
     - When reviewing or fixing someone else's PR, don't ask for or open an issue. Note an external contributor's public API change when it has neither an agreed issue nor an API-defining published spec.

CONTRIBUTING.md

@@ -2,6 +2,10 @@
 
 Thank you for your interest in contributing to the PostHog Unity SDK! This document provides guidelines and instructions for development.
 
+## Commit signing
+
+This repo requires all commits to be signed. To configure commit signing, see the [PostHog handbook](https://posthog.com/handbook/engineering/security#commit-signing). Set `commit.gpgsign` to `true` in your git config so that every commit is signed, not only the ones you sign by hand.
+
 ## Development Setup
 
 ### Prerequisites
@@ -143,6 +147,7 @@ This section is for external contributors. PostHog maintainers (members of the P
 
 ### PR Checklist
 
+- [ ] All commits are signed (see [Commit signing](#commit-signing))
 - [ ] Tests pass (`bin/test`)
 - [ ] Code is formatted (`bin/fmt --check`)
 - [ ] Documentation updated (if applicable)