Cosign image verification described in Readme stopped working starting with 2026.4.1

### Repository Confirmation

- [x] I understand this repository only tracks self-host installation scripts. Application issues (including Bitwarden Lite) should be reported in bitwarden/server.

### Steps to reproduce

1. Try to verify the signature of a bitwarden image as described in the readme.
2. Verification fails.

### Expected behavior

Image signature verification to succeed.

### Actual behavior

Image signature verification fails

### Environment

Self-Hosted

### Version / Image tag

bitwarden/api:2026.8.0

### Environment details

- Cosign v3.1.3

### Logs, screenshots and configuration

```
$ cosign verify ghcr.io/bitwarden/api:2026.8.0 \
--certificate-identity-regexp="https://github\.com/bitwarden/self-host/\.github/workflows/release\.yml@.*" \
--certificate-oidc-issuer="https://token.actions.githubusercontent.com"

Error: no matching attestations: failed to verify certificate identity: no matching CertificateIdentity found, last error: expected SAN value to match regex "https://github\.com/bitwarden/self-host/\.github/workflows/release\.yml@.*", got "https://github.com/bitwarden/deploy/.github/workflows/release-self-host.yml@refs/heads/main"
failed to verify certificate identity: no matching CertificateIdentity found, last error: expected SAN value to match regex "https://github\.com/bitwarden/self-host/\.github/workflows/release\.yml@.*", got "https://github.com/bitwarden/server/.github/workflows/build.yml@refs/heads/rc"
error during command execution: no matching attestations: failed to verify certificate identity: no matching CertificateIdentity found, last error: expected SAN value to match regex "https://github\.com/bitwarden/self-host/\.github/workflows/release\.yml@.*", got "https://github.com/bitwarden/deploy/.github/workflows/release-self-host.yml@refs/heads/main"
failed to verify certificate identity: no matching CertificateIdentity found, last error: expected SAN value to match regex "https://github\.com/bitwarden/self-host/\.github/workflows/release\.yml@.*", got "https://github.com/bitwarden/server/.github/workflows/build.yml@refs/heads/rc"
```

### Additional context

I found that using something like the following works. I can't judge if that is a good solution though.
```bash
cosign verify ghcr.io/bitwarden/api:2026.8.0 \
--certificate-identity='https://github.com/bitwarden/deploy/.github/workflows/release-self-host.yml@refs/heads/main' \
--certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
--certificate-github-workflow-repository='bitwarden/deploy'
```

Btw. i tracked down that the image verification stops working from 2026.4.1 and upwards.

### Issue Tracking Information

- [x] I understand that work is tracked outside GitHub. Pull requests may be linked to this issue, but Bitwarden does not use GitHub Assignments, Milestones, or Projects to track progress.

Start with the Cosign verification command in the README and compare its certificate identity with the identities shown in the failure output for the deploy and server workflows. Confirm the correct command against bitwarden/api:2026.8.0 and update the README instructions so verification succeeds for current images.

Written by the indexing model from the issue text.