chore: replace signed-commit check with Carson's signed-commits

[paulbalandan]

Description
Third step of the move onto Carson, following #10529, #10547, and #10553. This PR retires the 1Password/check-signed-commits-action workflow and enables Carson's signed-commits subscriber in its place.

Changes:

• .github/carson.yml: enable signed-commits with the check named Carson / signed-commits and treat_unsigned_as: failure. Both are the defaults, written out so the check name and the failure mode are visible in config.
• Remove .github/workflows/label-signing.yml.
• No workflow change: run-carson.yml already runs on opened, synchronize, and reopened, and the App has checks: write.

Behaviour changes:

• Unsigned commits are reported as a failing check run that lists each offending commit (short SHA, subject, author), instead of a PR comment. The subscriber has no message setting, so the comment linking to our signing docs goes away. The contributing guide remains the reference: signing and gpg-signing-old-commits.
• The check is a single rolling run per PR, updated on every push, so the checks list never accumulates stale entries.
• The old workflow only ran for PRs targeting develop and 4.*. Carson checks every PR.
• GitHub's own verification rules apply: GPG, SSH, and S/MIME signatures all count, as do commits made through the web UI.

Next: welcome and template-enforcer for Mergeable, which is the last external app.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide