fix(sign): read op-ssh-sign's signature file

[heymage]

What & why

Fixes #58. Committing with 1Password signing (gpg.ssh.program = op-ssh-sign) failed with "ssh-keygen produced no signature", although 1Password approved the request.

sign_with_ssh wrote the commit buffer to angkorgit-sign-<pid>-<nanos>.buf and read the signature from ….buf.sig. ssh-keygen -Y sign appends .sig to the file name, but op-ssh-sign replaces the extension, so it wrote ….sig. Git's own signing buffer (.git_signing_buffer_tmpXXXX) has no extension, which is why git commit works with the same config.

The buffer file now has no extension (temp_file("")), so both signers write to <buffer>.sig.

Verified on macOS 27.0.1 with 1Password 8.12.38: the engine's sign_buffer returns a signature for the 1Password key, and a commit from a local build is signed.

Screenshots

None, this is an engine-only change.

Checklist

• pnpm typecheck && pnpm test pass
• cargo fmt --check && cargo clippy --all-targets -- -D warnings && cargo test pass (if Rust changed)
• New engine functions have integration tests in tests/git_engine.rs
• Mutating operations go through the undo tracked() wrapper where undoable
• CLAUDE.md updated if conventions/architecture changed
• Commits carry no trailers from coding tools (Co-authored-by: <tool>, Generated with …)