Make gittuf hash-algorithm aware so it operates on SHA-256 repositories:
- gitinterface.Repository detects its object format (via
`git rev-parse --show-object-format`) and exposes GetObjectFormat and a
per-repo ZeroHash. GetReference returns the format-appropriate zero hash
so ref updates to new refs succeed in SHA-256 repositories.
- Commit and tag signing/verification use the `gpgsig-sha256` header for
SHA-256 objects (go-git's SignatureSHA256), matching Git's behavior. The
verification field is chosen by the object's OID length. Fixes verify-ref
failing on Git-signed SHA-256 RSL entries.
- git-remote-gittuf negotiates object-format from the repository instead of
hardcoding sha1, and uses the repo-appropriate zero hash for ref tips.
- Test helpers can create SHA-256 repositories; gitinterface, rsl, policy,
and experimental/gittuf suites now run under both formats, plus an
end-to-end Git-signed record+verify test.
Assisted-by: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Paulo Gomes <paulo@entire.io>
