How does the signature verification feature in bitcoin-qt work without a public key?
The ECDSA public key can be recovered from the signature.

See this bitcointalk thread and the linked pdf for details.