Add Groundwire PR verification

[nisfeb]

Summary

Adds the Groundwire PR verification workflow. All commits in PRs must be signed with a Groundwire identity, verified against on-chain keys via https://vitriol.bot.

Setup

Add these repo secrets (Settings > Secrets > Actions):

Secret	Value
GROUNDWIRE_ENDPOINT	https://vitriol.bot
GROUNDWIRE_AUTH	(empty — vitriol.bot has public verification enabled)

What it does

1. Extracts Groundwire signature from each commit's gpgsig header
2. Sends to vitriol.bot for Ed25519 verification against on-chain keys
3. If ecash tokens are present, polls for async NUT-03 swap verification
4. Fails the check and comments on the PR if any commit is unsigned

[github-actions]

Groundwire Verification Failed

This PR will not be reviewed because commits are not signed by a recognized Groundwire ID.

UNSIGNED 5d85dad0

Why?

This repository requires contributors to prove ownership of an onchain Groundwire identity.
Commit signatures are cryptographically verified against the signer's on-chain networking key.

How to fix this

1. Get a Groundwire ID — groundwire.network/get-started
2. Install commit signing — ./hooks/install.sh <your-ship-url>
3. Re-sign your commits — git rebase --exec "true" HEAD~N (after configuring signing)

---

This repository is protected by Groundwire for GitHub.