Fix release Cosign bundle signing

[plutoless]

Summary

• update GoReleaser Cosign signing to emit checksums.txt.sigstore.json via --bundle
• update release verification docs and proposal sketch for bundle-based verification
• add changelog entry for the release-signing fix

Tests

• go test ./...
• git diff --check
• YAML parse check for .goreleaser.yaml