fix(release): cosign sign lacks --certificate-identity binding

## Summary
The cosign sign step in .github/workflows/release.yml (line 541) does NOT pass --certificate-identity or --certificate-identity-regexp. Today only release.yml has id-token: write, but if a future workflow file with id-token: write runs cosign sign --yes, the resulting Fulcio certificate has a different sub (= different workflow_ref). Any verifier that runs cosign verify without --certificate-identity will accept both signatures as valid — asymmetric with actions/attest which DOES bind the certificate identity to the workflow_ref automatically.

## Suggested fix
```yaml
cosign sign --yes \
--certificate-identity "https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release.yml@refs/tags/${TAG}" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
"${{ steps.meta.outputs.image }}@${DIGEST}"
```

## Source
F2 audit round (post-v2.11.3 release).

Start at .github/workflows/release.yml around line 541 and inspect the cosign sign step. Apply the suggested certificate identity and OIDC issuer arguments for the release tag workflow, then validate the workflow syntax and confirm the signing command still targets the image digest.

Written by the indexing model from the issue text.