Add cosign keyless signing for release artifacts

[pjbgf]

Configure goreleaser to sign checksums.txt using cosign with Sigstore OIDC-based ephemeral keys. Install cosign in the release workflow and grant id-token permission for the OIDC token. Add download and verification instructions to the README Quick Start.

---

Note

Medium Risk
Changes the release pipeline to use GitHub OIDC and cosign for keyless signing, which could break or block publishing if CI permissions or signing steps are misconfigured.

Overview
Adds keyless Sigstore/cosign signing to the release process by granting id-token: write and installing cosign in the GitHub Actions release workflow.

Configures GoReleaser to run cosign sign-blob on the generated checksums.txt, publishing the .sig and .pem alongside the release.

Updates the README with manual download + verification steps for release artifacts using cosign verify-blob and checksum validation.

^{Written by Cursor Bugbot for commit 176abe3. Configure here.}

[Copilot]

Pull request overview

This PR adds keyless Sigstore/cosign signing for release checksum artifacts and documents how users can manually verify release downloads, aligning the project’s release process with stronger supply-chain integrity practices.

Changes:

• Configure GoReleaser to sign checksums.txt using cosign keyless signing and emit .sig + .pem outputs.
• Update the GitHub release workflow to install cosign and request id-token permissions for OIDC-based signing.
• Add README instructions for downloading and verifying artifacts using the signed checksums.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
README.md	Adds manual download + cosign verification steps for release artifacts.
.goreleaser.yaml	Adds cosign-based signing for the checksum artifact and outputs certificate/signature files.
.github/workflows/release.yml	Installs cosign in CI and enables OIDC token permissions for keyless signing.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

[cursor]

Verification regexp matches unintended repositories in same org

Low Severity

The --certificate-identity-regexp 'github\.com/entireio/cli' pattern is an unanchored substring match, so it matches any Fulcio certificate SAN containing that string — including repos like entireio/client or entireio/cli-tools, since client starts with cli. The Sigstore best practice (per cosign issue #2804) is to use an anchored, path-specific pattern like 'https://github\.com/entireio/cli/\.github/workflows/release\.yml@refs/tags/v' to prevent unintended matches from other workflows or repositories.