Fix release workflow: use cosign bundle format

[wnstfy]

Summary

First release of v2026.05.21 failed at the cosign signing step:

Error: signing SHA256SUMS: create bundle file: open : no such file or directory

Root cause: cosign v3 (installed by sigstore/cosign-installer@v4.1.2) deprecated --output-signature and --output-certificate in favor of --bundle. The deprecated flags are now silently ignored, and the command falls through to --bundle "" which fails.

Fix

• Switch to a single Sigstore bundle file: SHA256SUMS.sigstore.json (contains signature + certificate + Rekor inclusion proof in one artifact).
• .sigstore.json is the extension OpenSSF Scorecard's Signed-Releases check recognises as a Sigstore bundle.
• VERIFICATION.md updated: cosign verify-blob --bundle SHA256SUMS.sigstore.json ....

Next steps after merge

• Delete the orphaned v2026.05.21 tag (no release was published from it).
• Re-tag v2026.05.21 at the new main HEAD to trigger a clean release.

Test plan

• scan, lint, misconfig checks pass — verified actionlint clean locally.
• After merge + re-tag, the release workflow completes through Create GitHub Release and the four expected assets land on the Release page (.tar.gz, .zip, SHA256SUMS, SHA256SUMS.sigstore.json).
• cosign verify-blob --bundle ... succeeds against the downloaded SHA256SUMS.
• gh attestation verify succeeds against the downloaded .tar.gz.

[github-actions]

Trivy misconfiguration findings (HIGH + CRITICAL)

Findings below. Fix the issue or add an ignore entry to .trivyignore with a justification.

Report Summary

┌────────┬──────┬───────────────────┐
│ Target │ Type │ Misconfigurations │
├────────┼──────┼───────────────────┤
│   -    │  -   │         -         │
└────────┴──────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)