fix(release): cosign sign lacks --certificate-identity binding

## Summary
The cosign sign step in .github/workflows/release.yml (line 541) does NOT pass --certificate-identity or --certificate-identity-regexp. Today only release.yml has id-token: write, but if a future workflow file with id-token: write runs cosign sign --yes, the resulting Fulcio certificate has a different sub (= different workflow_ref). Any verifier that runs cosign verify without --certificate-identity will accept both signatures as valid — asymmetric with actions/attest which DOES bind the certificate identity to the workflow_ref automatically.

## Suggested fix
```yaml
cosign sign --yes \
--certificate-identity "https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release.yml@refs/tags/${TAG}" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
"${{ steps.meta.outputs.image }}@${DIGEST}"
```

## Source
F2 audit round (post-v2.11.3 release).