feat: add rc.gpg home module for Yubikey identity signing

[stackptr]

Summary

• Adds modules/home/gpg.nix — a new rc.gpg home module with enable option that configures gpg-agent for Yubikey-based SSH identity signing (smart card daemon, SSH support, reduced cache TTL, no external cache)
• Moves programs.gpg (gnupg install + default-key) and programs.git.signing (commit signing key + signByDefault) into rc.gpg, so they are only active when the module is enabled
• Removes home/services.nix — the old unconditional GPG config that was applied to all hosts
• Removes GPG and git signing config from modules/home/scm.nix
• Enables rc.gpg only for Rhizome via hosts/Rhizome/home.nix

Test plan

• Build and switch Rhizome: nh darwin switch .#Rhizome
• Verify gpg-agent starts with SSH support: echo $SSH_AUTH_SOCK should point to the gpg-agent socket
• Verify Yubikey is detected: gpg --card-status
• Verify SSH auth works with Yubikey key: ssh-add -L should list the key from the card
• Verify git commits are signed: git log --show-signature
• Confirm other hosts (glyph, spore, zeta) build without GPG agent configured