Ensure backport commits have verified signatures.

Branch protection requires verified commit signatures, but commits made
via `git push` from a workflow are never signed. Re-create each new
commit through the Git Data API instead: GitHub automatically signs
commits created this way, so the resulting chain shows as "Verified"
without needing to manage a GPG/SSH key for the bot.

Signed-off-by: Henry Wang <henrwang@nvidia.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>