sha256convert: use SetEncodedObject; rename --sign to --sign-mode

Address PR #66 review comments from @pjbgf.

go-git v6.0.0-alpha.4 (commit 5cab3a7) made objfile.Writer derive the hash format from the store config, so the SHA1-hardcoding that forced the hand-rolled loose-object writer is gone. Translated objects now go through dst.NewEncodedObject + SetEncodedObject, which binds each object to the target store's SHA256 hasher — the returned hash and the on-disk loose path are both SHA256. Drops encodeBody/writeLoose and the manual zlib/tempfile/rename plumbing; the on-disk sha256(content) invariant test is kept as a regression guard.

Replace the --sign bool with --sign-mode {none,tips} (default none), forward-compatible with a future "all" mode that signs every commit/tag. Run validates the value up front.