feat(push): add --no-sign to push unsigned commits

pkgmgr push --no-sign skips the re-sign rebase and the unsigned-range
refusal, so a checkout without a usable signing key can still sync the
fetch URL and every mirror pushurl. Leases and the git cherry guard
still apply. push_branch takes sign as a required keyword; pkgmgr
release and release --retry pass sign=True, so releases stay signed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/integration/test_push_mirror_leases.py

@@ -80,9 +80,27 @@ class TestPushMirrorLeases(unittest.TestCase):
     def _push(self, rewrite: bool = False) -> str:
         with redirect_stdout(io.StringIO()) as out:
             sign_unpushed(self.repo)
-            push_branch(self.repo, [], rewrite=rewrite)
+            push_branch(self.repo, [], sign=True, rewrite=rewrite)
         return out.getvalue()
 
+    def _cli_push(self, cwd: str, *argv: str) -> None:
+        ctx = CLIContext(
+            config_merged={},
+            repositories_base_dir=os.path.join(self.root, "base"),
+            all_repositories=[],
+            binaries_dir=os.path.join(self.root, "bin"),
+            user_config_path=os.path.join(self.root, "config.yaml"),
+        )
+        args = create_parser("pkgmgr").parse_args(["push", "-j", "1", *argv])
+        prev = os.getcwd()
+        os.chdir(cwd)
+        self.addCleanup(os.chdir, prev)
+
+        with redirect_stdout(io.StringIO()), self.assertRaises(SystemExit) as cm:
+            maybe_handle_proxy(args, ctx)
+
+        self.assertEqual(cm.exception.code, 0)
+
     def _tip(self, bare: str, ref: str = "refs/heads/main") -> str:
         return subprocess.run(
             ["git", "rev-parse", "--verify", "--quiet", ref],
@@ -164,22 +182,9 @@ class TestPushMirrorLeases(unittest.TestCase):
         worktree = os.path.join(self.root, "wt")
         git(self.repo, "worktree", "add", "-q", "-b", "feature", worktree)
         head_before = self._commit("feature", worktree)
-        ctx = CLIContext(
-            config_merged={},
-            repositories_base_dir=os.path.join(self.root, "base"),
-            all_repositories=[],
-            binaries_dir=os.path.join(self.root, "bin"),
-            user_config_path=os.path.join(self.root, "config.yaml"),
-        )
-        args = create_parser("pkgmgr").parse_args(["push", "-j", "1"])
-        cwd = os.getcwd()
-        os.chdir(worktree)
-        self.addCleanup(os.chdir, cwd)
 
-        with redirect_stdout(io.StringIO()), self.assertRaises(SystemExit) as cm:
-            maybe_handle_proxy(args, ctx)
+        self._cli_push(worktree)
 
-        self.assertEqual(cm.exception.code, 0)
         head = git(worktree, "rev-parse", "HEAD")
         self.assertNotEqual(head, head_before)
         self.assertEqual(self._tip(self.canonical, "refs/heads/feature"), head)
@@ -188,6 +193,16 @@ class TestPushMirrorLeases(unittest.TestCase):
             git(worktree, "rev-parse", "--abbrev-ref", "@{u}"), "origin/feature"
         )
 
+    def test_no_sign_pushes_unsigned_commits_to_every_url(self) -> None:
+        unsigned = self._commit("feature")
+
+        self._cli_push(self.repo, "--no-sign")
+
+        self.assertEqual(git(self.repo, "rev-parse", "HEAD"), unsigned)
+        self.assertEqual(self._tip(self.canonical), unsigned)
+        self.assertEqual(self._tip(self.mirror), unsigned)
+        self.assertEqual(git(self.repo, "log", "-1", "--format=%G?"), "N")
+
     def test_release_retry_refuses_unsigned_range(self) -> None:
         self._commit("release")
         git(self.repo, "tag", "-a", "v1.0.0", "-m", "v1.0.0")

tests/unit/pkgmgr/actions/release/test_retry.py

@@ -83,7 +83,9 @@ class TestRetryRelease(unittest.TestCase):
 
         retry_release(pyproject_path="pyproject.toml", preview=False)
 
-        mock_push.assert_called_once_with(".", [], refs=("v1.13.4",), preview=False)
+        mock_push.assert_called_once_with(
+            ".", [], sign=True, refs=("v1.13.4",), preview=False
+        )
         mock_update_latest.assert_called_once_with("v1.13.4", preview=False)
 
     @patch("pkgmgr.actions.release.retry.update_latest_tag")
@@ -143,7 +145,9 @@ class TestRetryRelease(unittest.TestCase):
 
         retry_release(pyproject_path="pyproject.toml", preview=False)
 
-        mock_push.assert_called_once_with(".", [], refs=("v2.0.0",), preview=False)
+        mock_push.assert_called_once_with(
+            ".", [], sign=True, refs=("v2.0.0",), preview=False
+        )
 
 
 if __name__ == "__main__":