CI: pin sigstore/cosign-installer to v4.1.2; it has no v4 tag

.github/workflows/ci.yml

@@ -334,7 +334,8 @@ jobs:
 
       - name: Install Cosign
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: sigstore/cosign-installer@v4
+        # A full version: cosign-installer publishes no major tag (no v4).
+        uses: sigstore/cosign-installer@v4.1.2
         with:
           # Match the pin in release.yml so both signing surfaces
           # (docker image here, checksums.txt in release.yml) use the

.github/workflows/release.yml

@@ -87,7 +87,8 @@ jobs:
         uses: anchore/sbom-action/download-syft@v0
 
       - name: Install Cosign for checksum signing
-        uses: sigstore/cosign-installer@v4
+        # A full version: cosign-installer publishes no major tag (no v4).
+        uses: sigstore/cosign-installer@v4.1.2
         with:
           # Pin cosign itself, not just the installer action. The rest
           # of the supply-chain tooling pins tightly (golangci-lint

AGENTS.md

@@ -295,8 +295,11 @@ CI is GitHub Actions:
 | [fuzz.yml](.github/workflows/fuzz.yml) | Nightly at 04:00 UTC: every fuzz target. |
 | [mutation.yml](.github/workflows/mutation.yml) | Weekly on Sunday at 03:00 UTC: the full gremlins run. |
 
-Actions are pinned by major version (`@v7`), and Dependabot proposes the
-bumps.
+Actions are pinned by major version (`@v7`), except
+`sigstore/cosign-installer`, which publishes no major tags and is pinned to a
+release (`@v4.1.2`); Dependabot proposes the bumps. A tag-only job is the
+first to use an action's new ref, so check that the ref exists before bumping
+one.
 
 PRs run, in this order: