fix(ci): sign release checksums with cosign --bundle

[mayankpande88]

Description

The github-release job of the release workflow fails for every release, and took out the v0.1.3 run.

cosign-installer v4 ships cosign v3, which defaults to the new bundle format. In that mode --output-signature and --output-certificate are ignored (cosign logs a deprecation warning for each), and a single --bundle file carries the signature, Fulcio certificate and transparency-log entry together. With neither flag honoured and no --bundle supplied, cosign tries to create a bundle at an empty path:

WARNING: --output-signature is deprecated when using --new-bundle-format and will be ignored
WARNING: --output-certificate is deprecated when using --new-bundle-format and will be ignored
Error: signing checksums.txt: create bundle file: open : no such file or directory

This is not specific to v0.1.3 — it fails on any tag pushed with a current cosign.

Impact on v0.1.3

Everything else in that release succeeded: the image (0.1.3, latest, 0.1), Helm chart, binaries for all five platforms, SBOM, image signature and both ECR mirrors. Only the GitHub Release page and the signed checksums.txt are missing. The release entry is being created manually from the artifacts that run already built.

The fix

Switch to cosign sign-blob --yes --bundle checksums.txt.bundle checksums.txt. The upload step already globs dist/*, so the bundle ships with no further change.

Verification instructions are recorded inline in the workflow, since the flag change also changes how consumers verify a download:

cosign verify-blob --bundle checksums.txt.bundle \
  --certificate-identity-regexp '^https://github.com/nudgebee/forager/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt
sha256sum -c checksums.txt

The CHANGELOG entry advertising checksums.txt.sig / .pem is corrected to match what actually ships — that feature has never worked as documented.

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

• Unit tests
• Manual testing

Not directly executable outside CI — keyless signing needs the workflow's OIDC token, so this is verified on the next tag push. What was checked:

• --bundle is the current flag for both sign-blob and verify-blob in cosign's published documentation; --output-signature / --output-certificate no longer appear there.
• The failure was reproduced from the v0.1.3 run log, which shows both deprecation warnings immediately before the empty-path error.
• Workflow YAML parses.

Checklist

• CLA signed (the CLA bot will prompt on your first PR)
• make validate passes (fmt + lint + test) — unchanged, no Go code touched
• Docs updated if the wire shape, config surface, or proxy module behavior changed — CHANGELOG corrected; no runtime behaviour change

[gemini-code-assist]

Code Review

This pull request updates the CHANGELOG.md to specify that keyless cosign signatures for release artifacts are now shipped as checksums.txt.bundle instead of checksums.txt.sig and .pem. No review comments were provided, and there is no additional feedback.