fix(client): populate Signature field correctly for key-based signatures

[paralta]

When #1609 added Signature and ContentType fields to PerSignatureResult, it populated Signature as base64(sig.GetContentBundle()). For key-based signatures, ContentBundle is always empty (it only carries the Sigstore bundle for OIDC), so the reconciler was writing an empty Signature to every key-based row in signature_verifications. The catalogSignatures function in the AI catalog explicitly skips any row where Signature == "", meaning key-signed records silently lost their trustManifest in the /v1/agents response.

The fix uses sig.GetSignature() (the actual base64-encoded cryptographic signature) when ContentBundle is empty, falling back to base64(ContentBundle) only for OIDC signatures where the bundle is the meaningful identifier.

Fixes #1620

[codecov]

Codecov Report

❌ Patch coverage is 50.00000% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
client/utils/verify/fetcher.go	50.0%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!