Bug: MarkSigned called despite signer-load or format-not-found failures (signed=true with no signature)

Expected Behavior

When Chains fails to sign a TaskRun or PipelineRun due to an invalid/missing signing secret, misconfigured signer, or unknown payload format the reconciler should return an error and not set chains.tekton.dev/signed=true, so that the signing is retried on the next reconcile loop.

Actual Behavior

chains.tekton.dev/signed=true is set on the TaskRun/PipelineRun even though nothing was signed. No chains.tekton.dev/payload-* or chains.tekton.dev/signature-* annotations are written. Retries are permanently suppressed.

This happens because two continue paths in ObjectSigner.Sign() in pkg/chains/signing.go do not append to merr, so merr remains nil and MarkSigned() is called unconditionally:

Path 1 — format not found:

payloader, err := formats.GetPayloader(payloadFormat, cfg)
if err != nil {
    logger.Warnf("Format %s configured for %s: %v was not found", ...)
    continue  // merr not appended
}

Path 2 — signer not configured (invalid/missing secret):

signer, ok := signers[signerType]
if !ok {
    logger.Warnf("No signer %s configured for %s", ...)
    continue  // merr not appended
}

Note: The same class of bug for CreatePayload, getRawPayload, and SignMessage failures was partially fixed by PR #1666. These two paths were called out by @ab-ghosh in that PR but are out of scope for it.

Steps to Reproduce the Problem

1. Create a kind cluster and install Tekton Pipelines
2. Deploy Chains via ko apply -f config/
3. Create invalid signing secret:

kubectl create secret generic signing-secrets -n tekton-chains \
  --from-literal=cosign.key="-----BEGIN ENCRYPTED COSIGN PRIVATE KEY-----
dGhpcyBpcyBub3QgYSByZWFsIGtleQ==
-----END ENCRYPTED COSIGN PRIVATE KEY-----" \
  --from-literal=cosign.pub="invalid" \
  --from-literal=cosign.password=""

4. Deploy Chains again via ko apply -f config/ (ensures fresh pod with no kubelet secret cache)
5. Submit a TaskRun:```bash
   kubectl apply -f - <<'EOF'
   apiVersion: tekton.dev/v1
   kind: TaskRun
   metadata:
   name: signing-bug-repro
   spec:
   taskSpec:
   steps:
   • name: echo
     image: alpine
     script: echo "hello"
     EOF

5. Wait ~15s after the TaskRun succeeds, then check annotations:
```bash
kubectl get taskrun signing-bug-repro -o json | jq '.metadata.annotations'

Result: chains.tekton.dev/signed=true is set but payload-* and signature-* annotations are absent.

Controller logs show:

WARN  error configuring x509 signer: ...
WARN  No signer x509 configured for taskrun
INFO  Reconcile succeeded

• Originally noted by @ab-ghosh in https://github.com/tektoncd/chains/pull/1666#issuecomment-2961693152
• Related issue: #1663 (partial fix via PR #1666)