Release signs the linux artifacts: keyless Cosign image + tarball provenance

[erikdarlingdata]

Ports the nightly's signing steps — proven end-to-end today — into the release arm:

• Nightly :nightly image signature verified from a client: cosign validated the claims, the Rekor transparency-log entry, and the workflow identity (nightly.yml@refs/heads/dev).
• Nightly tarball SLSA v1 provenance verified via gh attestation verify (exit 0, digest match, same workflow identity).

Release arm gets identical steps with versioned tags (:<version> digest signed; tarball attested), gated if: github.event_name == 'release' so PR/push behavior is unchanged. Job permissions add id-token: write + attestations: write. CHANGELOG's Linux-integrity paragraph updated with both verify commands.

Context: SignPath's cosign-sign and create-gpg-signature are edition-gated on the FOSS subscription (probed in the artifact-configuration editor today) — SignPath remains the Windows Authenticode signer, Sigstore covers Linux with no subscription or key management.

🤖 Generated with Claude Code

[claude]

Reviewed the diff (.github/workflows/build.yml + CHANGELOG.md only — no T-SQL, no app code, no Lite/Darling parity surface here, and this repo currently has no CLAUDE.md/style guide to check conventions against).

Findings: none blocking.

Went through the release-arm additions against their nightly.yml counterpart line by line:

• id-token: write / attestations: write at the darling-linux job level are actually required here, not redundant with the workflow-level permissions: block (line 18-21) — this job already defines its own job-level permissions: (contents/packages write), and GitHub Actions job-level permissions fully replace the workflow-level block rather than merging with it. Correct call.
• The four new release-only steps (install cosign, sign image, attest tarball) are all gated if: github.event_name == 'release', consistent with the rest of the release-only steps in this job.
• cosign sign targets the digest resolved from ${image}:${version} — since :${version} and :latest are pushed from the same build/tag operation, they share a digest, so this signs the same content regardless of which tag is used to look it up.
• Command/flag values (--certificate-identity-regexp, --certificate-oidc-issuer, subject-path glob) match nightly.yml's already-verified pattern exactly.
• CHANGELOG wording accurately describes the new verify commands.

Minor, non-blocking observation: sigstore/cosign-installer@v3 is pinned to a moving major-version tag rather than a SHA, on a job that now holds id-token: write. Not something introduced by this PR specifically — it matches the exact pattern already merged in nightly.yml — so flagging only for awareness, not requesting a change here.