v0.13.0-rc4

Changelog

• 3ecf8b3 Add comprehensive tests for artifact upload behavior
• 2d1fb81 Avoid re-uploading downloaded artifacts in sign-cache
• 16ee59d Bump github.com/hashicorp/go-getter from 1.7.8 to 1.7.9
• 5447815 Fix non-deterministic gzip compression
• 2debc63 build(deps): Bump github.com/containerd/containerd from 1.7.26 to 1.7.29
• 819464d build(deps): Bump github.com/opencontainers/runc from 1.1.10 to 1.2.8
• 95ff8c8 build(deps): Bump github.com/opencontainers/selinux
• 8932b3a build(deps): revert to v0.12.0 dependencies for v0.13.0 release
• bd51715 docs(signing): clarify Fulcio's role in builder ID extraction
• 7c393af feat(signing): enforce strict OIDC extraction, remove fallback
• cfc3325 feat(signing): support top-level job_workflow_ref claim as fallback
• a1d91f4 fix(lint): check error return value in test mock server
• b467877 fix(lint): check error return values in signing package
• 8b49f6a fix(pkg/leeway/signing): extract builder ID from OIDC
• ffb6270 fix(signing): validate whitespace-only sub claims
• 74d751f refactor(test): consolidate extractJobWorkflowRef test functions
• 666b52e refactor(test): encapsulate expected values in want struct
• c180092 refactor(test): replace os.Setenv with t.Setenv for automatic cleanup
• 130268b refactor(test): use cmp.Diff for struct comparisons
• ddea58c test(pkg/leeway/signing): test the extraction of job_workflow_ref/builder ID from OIDC sub claims