Add package signature verification

[CoderSufiyan]

Verify package signatures, release signatures, and published checksums during MCP verification.

Acceptance criteria:

• Support npm signature/provenance evidence where available
• Support GitHub release signatures and checksums
• Distinguish signed, unsigned, invalid, and unverifiable artifacts
• Include evidence in text, JSON, and Markdown reports
• Never treat an unsigned package as automatically malicious

Depends on: #32 and #36

Milestone: 1.0