ci: sign renovate's commits

.gitea/workflows/renovate.yaml

@@ -19,6 +19,9 @@ jobs:
           RENOVATE_ENDPOINT: https://git.neuf.no/api/v1
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
           RENOVATE_GIT_AUTHOR: Renovate <renovate@neuf.no>
+          # ed25519 key; its public half is on the renovate account. Gitea shows a commit as
+          # verified only if the author email is a verified email on that account.
+          RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_GIT_PRIVATE_KEY }}
           # Every edb repository the renovate account can write to
           RENOVATE_AUTODISCOVER: "true"
           RENOVATE_AUTODISCOVER_FILTER: edb/*