ENG-1715: Sign generated-list commits

[JonathanGawrych]

Automated list updates now create GitHub-signed commits with commit-headless using a CI App, so they can satisfy required commit signing and the App can bypass the main branch's pull-request requirement. Correct the branch-protection restore step to target etherfuse/tokenAssets.

Validation: actionlint reports only the existing checkout/setup-node runtime warnings; git diff --check passes. List generation, IPFS publishing, and branch-protection changes were not executed locally.

Configuration complete: the Tag and Release environment is restricted to main and contains RELEASE_APP_CLIENT_ID and RELEASE_APP_PRIVATE_KEY for etherfuse-ci-bot. Verified the private key authenticates as that App, its repository access includes Contents: write, and its pull-request ruleset bypass is configured. The existing ACCESS_TOKEN remains in use for the branch-protection steps.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b328746. Configure here.}

[jordantgates]

Reviewed tracked-file staging, the signed commit action, the existing bot-message loop guard, and the correction of the protection-restore repository owner. Validation CI and YAML/shell syntax checks pass. Code approved with the documented setup prerequisite: the CI App needs its own branch-rule bypass; toggling enforce_admins does not provide that. Confirm the release credentials and App access before merging. List generation, IPFS publication, and protection changes were not executed.