ci: sign release artifacts with cosign (keyless, OIDC)

[scott]

Motivation

Release artifacts are currently verified only by SHA256 hashes, downloaded from the same host as the binary. That's fine over HTTPS in practice, but a signed checksums file gives cryptographic continuity against a compromised release. cosign with keyless signing via GitHub OIDC is the lowest-friction choice — no long-lived key to manage, no secret to leak, and the verification side is a single cosign verify-blob call in the upgrade path (covered by #34).

Approach

• Use sigstore/cosign-installer@v3 to install cosign in the release job.
• Run cosign sign-blob over the combined SHA256SUMS.txt (artifact emitted by ci: add windows-amd64 and windows-arm64 to release matrix #31) once it exists, otherwise over the first per-asset checksum file as a transitional artifact.
• Attach the resulting SHA256SUMS.txt.sig and SHA256SUMS.txt.bundle to the release.

Acceptance criteria

1. New release steps in .github/workflows/release.yml's release job:
   • sigstore/cosign-installer@v3.
   • cosign sign-blob --output-signature SHA256SUMS.txt.sig --bundle SHA256SUMS.txt.bundle SHA256SUMS.txt --yes (transitional: over the first per-asset sidecar if ci: add windows-amd64 and windows-arm64 to release matrix #31 hasn't landed).
2. id-token: write is added to the release job's permissions: block (required for keyless OIDC signing).
3. Both SHA256SUMS.txt.sig and SHA256SUMS.txt.bundle are listed under files: in softprops/action-gh-release@v3.
4. A successful v0.0.0-rc.1 test tag produces both files, and cosign verify-blob --certificate-identity-regexp '.*' --certificate-oidc-issuer-regexp 'https://token.actions.githubusercontent.com' --bundle SHA256SUMS.txt.bundle --signature SHA256SUMS.txt.sig SHA256SUMS.txt exits 0.

Out of scope

• Verification in gander --upgrade is covered by feat: verify cosign signature in gander --upgrade #34.
• macOS notarization for Homebrew formula is unrelated.