Release pipeline validation: SBOM, signing, draft to publish

[abienkowski]

Problem

The release pipeline (release.yml) has not been validated end-to-end on a real release. Drafts exist but the artifacts (binaries, SBOMs, signatures) have not been verified.

Solution

1. Run the full pipeline on a real tag and verify:
   • Go binary + TS tarball + Rust binary attached to the release
   • SPDX + CycloneDX SBOMs generated by syft from Docker images for all three languages
   • Cosign signatures present and verifiable (cosign verify)
2. Verify Docker images pushed to GHCR (ghcr.io/chainsafe/docker-socket-policy-{go,rs,ts}) with correct tags
3. Test the draft → publish flow and confirm release notes render correctly
4. Confirm the version job bump logic handles edge cases (no existing tags, pre-release tags)

Which implementation(s) would this affect?

• All

Additional context

• Workflow: .github/workflows/release.yml
• Drafts to inspect: v0.2.1–v0.2.6
• Tracked by epic First release prep: Quint spec review, test parity, and release pipeline validation #4