release: cosign signatures, SBOM, and SLSA provenance for artifacts

[jamiesun]

Background

A security-positioned execution tool should ship verifiable artifacts. Currently releases are unsigned archives + checksums built in CI.

Plan

• Sign release artifacts with cosign keyless (GitHub OIDC) in release.yml; publish .sig + certificate alongside archives.
• Generate SBOM (syft, SPDX or CycloneDX) per release artifact.
• Add SLSA provenance attestation via the official slsa-github-generator reusable workflow (or actions/attest-build-provenance).
• Document verification steps (cosign verify-blob …) in RELEASE.md and the install docs; install.sh optionally verifies when cosign is present.

Acceptance

• Tagged release publishes sig + SBOM + provenance for every platform artifact
• Verification commands documented and tested against a real release
• Homebrew tap unaffected