v0.6.0 — sigstore is now optional

perf: make sigstore an optional dependency

Move sigstore from dependencies to optionalDependencies. Users who
do not enable provenance.mode (the default) no longer install sigstore
and its ~160 transitive packages. This reduces installed package count
from ~165 to ~5, improves install speed, and eliminates all six
supply-chain warnings that Socket and Snyk flagged on the sigstore
dependency subtree.

When provenance.mode is enabled and sigstore is not installed, the
lazy-loader now surfaces a clear error message telling the user to
install it manually.

For users who do install sigstore (either explicitly or because their
package manager resolves optional deps by default), the behavior is
identical to 0.5.0.