# `muse commit --sign` is agent-only, silently no-ops for human commits

## Background

Discovered while recording *Build with Muse* episode 04, "Identity, Without
Passwords" — the whole point of the episode is that any identity (human or
agent) can sign a commit with its Ed25519 key, no password required.

Repro:

```bash
muse auth whoami --json
# {"type": "human", "handle": "gabriel", "key_set": true, ...}

muse commit -m "adding README" --sign
# [main sha256:91e845a8...] adding README
# 1 file changed (1 added)
# -- no warning, no error --

muse read-commit sha256:91e845a8... --json
# "signature": "", "signer_public_key": "", "signer_key_id": ""

muse verify-commit sha256:91e845a8... --json
# "valid": false, "signer": "", "key_status": "unknown"
```

A real, registered human identity exists (confirmed via `muse auth whoami`
and `muse auth show`), yet `--sign` produced an unsigned commit with no
indication anything went wrong.

## Root cause

`muse/cli/commands/commit.py` gates the entire signing-resolution block on
both `sign` **and** `resolved_agent_id`:

```python
if sign and resolved_agent_id:
    from muse.cli.config import get_signing_identity
    signing = get_signing_identity(root, agent_id=resolved_agent_id)
    ...
```

A human commit has no `--agent-id`/`MUSE_AGENT_ID`, so `resolved_agent_id`
is `""` (falsy) — the whole block is skipped. `signing` stays `None`,
`pre_signer_public_key` stays `""`, and the commit is written unsigned.

This is unnecessary: `get_signing_identity()` already supports human-key
resolution when `agent_id` is `None`/falsy (see its docstring, resolution
order step 3: "Human entry in `~/.muse/identity.toml` keyed by bare
hostname"), and `resolve_signing_identity()` already treats falsy
`agent_id` as "skip the agent-specific lookup, go straight to the human
entry." `sign_commit_record()` also accepts an empty-string `agent_id`
fine — it's metadata-only, not part of key resolution. The gate at the
call site is the only thing preventing human signing from working.

## Fix

Change the gate to `if sign:` and pass `agent_id=resolved_agent_id or None`
so an empty string and `None` are treated identically all the way down
(defensive, even though both already resolve the same way today).

## Acceptance criteria

- `muse commit -m "..." --sign` as a human with a registered identity
  produces a commit with non-empty `signature`/`signer_public_key`.
- `muse verify-commit` on that commit reports `"valid": true`.
- Existing agent-signing behavior (`--sign --agent-id ...`) is unchanged.
- See companion issue #2 for the silent-failure behavior when no identity
  is configured at all.