Verified Commit Spoofing

IDE hook commits carry valid GitHub API-verified signatures with author field spoofed to github-actions[bot]. Upgrade from prior waves which used unsigned imposter commits. Detected in jaredwray/keyv (d8c850c7) and jaredwray/ecto (a4e7dd4f, c392617e, 5687c7ba).