chore: gate signAllPublications() on signingEnabled property
Without this, publishToMavenLocal fails because GPG signing is mandatory.
Local consumers (like the kima app) don't need signatures. CI publishing
to Maven Central can still opt-in via -PsigningEnabled=true.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>