govulncheck fails on dev-v3: x/crypto/openpgp advisory GO-2026-5932 has no fixed release

### What happened

`govulncheck` fails on the `dev-v3` branch, reporting a single vulnerability:

```
Vulnerability #1: GO-2026-5932
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design,
and generally unsuitable for production use.
More info: https://pkg.go.dev/vuln/GO-2026-5932
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.54.0
Fixed in: N/A
```

The reported call traces all originate in `pkg/provenance/sign.go` (provenance signing/verification via `x/crypto/openpgp`, `clearsign`, `armor`, `packet`, `s2k`, `elgamal`), e.g.:

- `pkg/provenance/sign.go:304` — `Signatory.decodeSignature` → `clearsign.Decode` → `armor.Decode`
- `pkg/provenance/sign.go:242` — `Signatory.ClearSign` → `clearsign.dashEscaper.Close` → `armor.Encode`
- `pkg/provenance/sign.go:315` — `Signatory.verifySignature` → `openpgp.CheckDetachedSignature`
- `pkg/provenance/sign.go:391` — `provenance.loadKey` → `openpgp.ReadEntity`

### Why a dependency bump can't fix it

- `golang.org/x/crypto` is a **direct** dependency, currently at `v0.54.0`, which is already the **latest published version** (released 2026-07-08).
- The advisory is `Fixed in: N/A` — `x/crypto/openpgp` is frozen/deprecated with no patched release coming.

So Dependabot has no higher version to offer, and this check will stay red on every Go PR to `dev-v3` until the code moves off the package (or the advisory is suppressed).

### Impact

Any Dependabot / Go dependency PR targeting `dev-v3` shows a failing `govulncheck` check (`mergeState=UNSTABLE`), even though all required checks pass. It's noise that obscures genuine govulncheck regressions and blocks a clean status.

### Possible resolutions

1. **Migrate `pkg/provenance` off `x/crypto/openpgp`** to a maintained fork such as [`github.com/ProtonMail/go-crypto/openpgp`](https://github.com/ProtonMail/go-crypto) (the community-standard drop-in replacement).
2. **Suppress the advisory** for `dev-v3` if a migration isn't desired within the v3 support window — e.g. scope the govulncheck run or document the accepted risk.
3. **Make `govulncheck` non-blocking** on `dev-v3` (it is already non-required for merge), with a note explaining the known unfixable advisory.

### Notes

- `main` may be affected the same way if it still imports `x/crypto/openpgp`.
- This surfaced while merging routine `size/XS` Dependabot PRs to `dev-v3`; the required checks (`build`, `golangci-lint`, `Analyze (go)`, `CodeQL`, `DCO`) all pass — only `govulncheck` is red.

Start by reviewing pkg/provenance/sign.go and the govulncheck workflow for dev-v3, then verify the reported call traces and advisory details. The issue offers migration, suppression, or non-blocking-check options but does not settle which approach maintainers want. Done means the check no longer reports this known advisory as a blocking failure while genuine vulnerability regressions remain visible.

Written by the indexing model from the issue text.