fix(release): migrate cosign signing to the Sigstore bundle format

[joshua-temple]

Problem

The Release workflow fails at the cosign signing step, blocking releases and the fleet gate. cosign-installer@v4.1.2 installs cosign v3.0.6, which defaults --new-bundle-format to true. In that mode cosign ignores --output-signature/--output-certificate and instead writes a single bundle file, so the goreleaser signs block (which passed only the two --output-* flags and no --bundle) tried to create a bundle at an empty path and failed:

Error: signing dist/checksums.txt: create bundle file: open : no such file or directory

Fix

Migrate the cosign sign-blob invocation to the Sigstore bundle format: pass --bundle=${signature}, drop the two --output-* flags, and produce a single checksums.txt.bundle artifact (it packages both the signature and the signing certificate). The GPG signing block is unchanged. docs/release-verification.md is updated to download and verify the .bundle with cosign verify-blob --bundle=checksums.txt.bundle.

The minimal alternative (adding --new-bundle-format=false to keep the separate .sig/.pem outputs) was tried first and rejected: cosign v3.0.6 no longer supports the legacy output-only mode and errors with must provide --new-bundle-format or --bundle.

Verification

Reproduced locally against the exact cosign the installer pins (go install github.com/sigstore/cosign/v3/cmd/cosign@v3.0.6, confirmed GitVersion: v3.0.6):

• cosign sign-blob --help shows --new-bundle-format=true is the default, matching the failure.
• The old shape (--output-certificate=... --output-signature=... <file> --yes) prints the deprecation warnings from the failure log and would write the bundle to an empty path.
• --new-bundle-format=false --output-signature=... <file> --yes fails with must provide --new-bundle-format or --bundle where applicable, confirming the legacy path is gone.
• The new shape sign-blob --bundle=checksums.txt.bundle <file> --yes parses cleanly and proceeds to ephemeral key generation and the OIDC device flow with no deprecation warnings (it only stops at the interactive OIDC step, which requires a real GitHub Actions token).
• goreleaser check passes on the edited .goreleaser.yaml.

Full end-to-end keyless signing is exercised by the Release workflow on the next rc tag.