fix(deps): Remove http2 module dependency from @sigstore/sign

- Add pnpm override to force @sigstore/sign@4.1.0
- Create patch to inline HTTP constants instead of importing http2
- Eliminates unnecessary http2 module load for HTTP/1.1 operations
- All constants verified against Node.js http2.constants

Author: jdalton

package.json

@@ -776,6 +776,7 @@
     "overrides": {
       "@npmcli/arborist": "9.1.6",
       "@npmcli/run-script": "10.0.0",
+      "@sigstore/sign": "4.1.0",
       "ansi-regex": "6.2.2",
       "lru-cache": "11.2.2",
       "semver": "7.7.2",
@@ -785,6 +786,7 @@
     },
     "patchedDependencies": {
       "@npmcli/run-script@10.0.0": "patches/@npmcli__run-script@10.0.0.patch",
+      "@sigstore/sign@4.1.0": "patches/@sigstore__sign@4.1.0.patch",
       "node-gyp@11.5.0": "patches/node-gyp@11.5.0.patch"
     }
   }

patches/@sigstore__sign@4.1.0.patch

@@ -0,0 +1,25 @@
+diff --git a/dist/external/fetch.js b/dist/external/fetch.js
+index 1111111111111111111111111111111111111111..2222222222222222222222222222222222222222 100644
+--- a/dist/external/fetch.js
++++ b/dist/external/fetch.js
+@@ -19,13 +19,18 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ */
+-const http2_1 = require("http2");
+ const make_fetch_happen_1 = __importDefault(require("make-fetch-happen"));
+ const proc_log_1 = require("proc-log");
+ const promise_retry_1 = __importDefault(require("promise-retry"));
+ const util_1 = require("../util");
+ const error_1 = require("./error");
+-const { HTTP2_HEADER_LOCATION, HTTP2_HEADER_CONTENT_TYPE, HTTP2_HEADER_USER_AGENT, HTTP_STATUS_INTERNAL_SERVER_ERROR, HTTP_STATUS_TOO_MANY_REQUESTS, HTTP_STATUS_REQUEST_TIMEOUT, } = http2_1.constants;
++// Inline HTTP header constants (lowercase, compatible with HTTP/1.1 and HTTP/2)
++const HTTP2_HEADER_LOCATION = 'location';
++const HTTP2_HEADER_CONTENT_TYPE = 'content-type';
++const HTTP2_HEADER_USER_AGENT = 'user-agent';
++const HTTP_STATUS_INTERNAL_SERVER_ERROR = 500;
++const HTTP_STATUS_TOO_MANY_REQUESTS = 429;
++const HTTP_STATUS_REQUEST_TIMEOUT = 408;
+ async function fetchWithRetry(url, options) {
+     return (0, promise_retry_1.default)(async (retry, attemptNum) => {
+         const method = options.method || 'POST';