v0.3.2

fix(release): pin cosign CLI to v2.6.3; prepare v0.3.2 (#85)

The v0.3.1 tag build failed at the signing step: cosign-installer
fetches latest cosign by default and cosign v3 ignores
--output-signature/--output-certificate in favor of the new bundle
format ('create bundle file: open : no such file or directory'). Pin
cosign-release v2.6.3 so the .sig/.crt assets documented in
docs/verifying-releases.md keep being produced; migrate to bundles
deliberately later.

v0.3.1 is already cached by the Go module proxy, so the tag must not
move — it stays a valid module version with no release binaries.
Prepare v0.3.2 instead (content-identical plus this pipeline fix):
changelog entry + bump usage examples to @v0.3.2.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>