[Security] Sign releases and add SLSA provenance

## Issue
OpenSSF Scorecard identified that releases are not cryptographically signed and lack provenance, scoring 0/10.

## Risk Level
**Medium** - Unsigned releases allow potential man-in-the-middle attacks and make it difficult to verify artifact authenticity.

## Current State
- Releases published without cryptographic signatures
- No SLSA provenance attestations
- Users cannot verify release artifact integrity
- Missing supply chain transparency

## Recommendation
Implement release signing and SLSA provenance for all published artifacts.

### Option 1: Sigstore/Cosign (Recommended)
Use keyless signing with Sigstore for simplicity and transparency:

**GitHub Actions Integration:**
```yaml
- name: Sign release artifacts
uses: sigstore/cosign-installer@v3
- name: Sign artifacts with cosign
run: |
cosign sign-blob --yes \
--bundle cosign.bundle \
tar-diff-linux-amd64
```

**Benefits:**
- No key management required (uses OIDC)
- Signatures stored in public Rekor transparency log
- Widely adopted in cloud-native ecosystem

### Option 2: SLSA Provenance Generator
Add build provenance using GitHub's SLSA generator:

```yaml
- uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
with:
base64-subjects: "${{ needs.build.outputs.hashes }}"
```

**Benefits:**
- Documents build process and dependencies
- Achieves SLSA Level 3 compliance
- Verifiable build reproducibility

### Option 3: GPG Signing (Traditional)
Use GPG keys to sign releases:
- Requires secure key storage and management
- More operational overhead
- Well-established in many ecosystems

## Recommended Implementation
Combine both approaches:
1. Use **Cosign** for artifact signing
2. Use **SLSA Generator** for build provenance
3. Publish signatures alongside release artifacts
4. Document verification process in README

## Steps to Implement
1. Add Cosign signing to `.github/workflows/release.yml`
2. Integrate SLSA provenance generator
3. Update release process to include signature verification instructions
4. Test with a pre-release to validate workflow
5. Document how users can verify signatures

## Verification Instructions (for users)
Once implemented, users can verify releases:
```bash
# Install cosign
go install github.com/sigstore/cosign/v2/cmd/cosign@latest

# Verify signature
cosign verify-blob \
--bundle cosign.bundle \
--certificate-identity-regexp="^https://github.com/containers/tar-diff" \
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
tar-diff-linux-amd64
```

## References
- [OpenSSF Scorecard - Signed Releases](https://github.com/ossf/scorecard/blob/main/docs/checks.md#signed-releases)
- [Sigstore/Cosign Documentation](https://docs.sigstore.dev/cosign/overview/)
- [SLSA Framework](https://slsa.dev/)
- [GitHub SLSA Generator](https://github.com/slsa-framework/slsa-github-generator)
- OpenSSF Scorecard Score: 0/10

## Related
Part of OpenSSF Scorecard evaluation THEEDGE-4717 (overall score: 6.8/10)