Fix gh-aw upgrade and unsigned PR branch pushes

[Copilot]

The previous gh-aw upgrade stopped at v0.74.2, which still refuses unsigned fallback pushes for PR branches containing merge commits. This updates the workflows to v0.74.4 and opts PR-branch pushes into the supported unsigned path.

• gh-aw lock refresh

  • Regenerated autoloop, evergreen, and ci-doctor locks with gh-aw v0.74.4.
  • Updated the setup action pin to 069305b523ecd7fbd05c5681a049b570b1fe6136.
  • Updated .github/aw/actions-lock.json to track v0.74.4.

• Unsigned push fallback

  • Configured workflows that use push-to-pull-request-branch to disable signed push transport:

safe-outputs:
  push-to-pull-request-branch:
    signed-commits: false

• Linear autoloop sync
  • Replaced merge-based main sync guidance with rebase-based sync to avoid creating merge commits on autoloop PR branches.
  • Updated evergreen’s repair flow to rebase behind branches before pushing fixes.