fix: pin auths-version in sign-commits dogfood workflow

Same gap as release.yml: the hardened installer throws on an unpinned
version, so the Sign Commits push workflow failed on main.

Author: bordumb

.github/workflows/sign-commits.yml

@@ -22,3 +22,5 @@ jobs:
       - uses: ./
         with:
           commits: 'HEAD~1..HEAD'
+          # The hardened installer never resolves `latest`; unpinned would throw.
+          auths-version: '0.0.1-rc.12'