Function sign_record 

pub fn sign_record(
    identity: &Identity,
    record: &Path,
    git_sha: &str,
) -> Result<PathBuf>

2026-09-26: Sign a record file already on disk with its sha; writes and returns the .sig sidecar path.