skill request: supply chain security — Sigstore/cosign for artifact signing and verification

## Summary

The repository has SBOM generation (`sbom-syft`) but no artifact signing or verification skills. [Sigstore/cosign](https://docs.sigstore.dev/cosign/overview/) has become the de facto standard for container image signing and software supply chain security, mandated by EO 14028, SLSA, and increasingly by enterprise software consumers. Without signing, SBOMs generated by Syft cannot be trusted by downstream consumers.

## Requested Skill: `secsdlc/supply-chain-cosign`

### What to Cover

**Core workflows**:

1. **Sign a container image after build**
```bash
# Keyless signing via OIDC (GitHub Actions / Fulcio CA)
cosign sign --yes ghcr.io/myorg/myapp:v1.2.3

# Sign with a key pair (air-gapped / self-hosted)
cosign sign --key cosign.key ghcr.io/myorg/myapp:v1.2.3
```

2. **Verify an image before deployment**
```bash
# Verify against Rekor transparency log
cosign verify \
--certificate-identity-regexp="https://github.com/myorg/myapp/.*" \
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
ghcr.io/myorg/myapp:v1.2.3
```

3. **Attach and verify a Syft SBOM** — pairs with `secsdlc/sbom-syft`
```bash
# Generate SBOM with Syft, attach to image with cosign
syft ghcr.io/myorg/myapp:v1.2.3 -o spdx-json > sbom.spdx.json
cosign attach sbom --sbom sbom.spdx.json ghcr.io/myorg/myapp:v1.2.3
cosign verify-attestation --type spdxjson ghcr.io/myorg/myapp:v1.2.3
```

4. **Policy enforcement with OPA** — reject unsigned images in K8s via Policy Controller
```bash
# Install Sigstore Policy Controller (admission webhook)
helm install policy-controller sigstore/policy-controller \
--set webhook.failOpen=false

# Apply ClusterImagePolicy requiring signatures
kubectl apply -f - <