ci: sign release artifacts with cosign and attach SPDX SBOMs - #824

Images and the CRD bundle now carry Sigstore signatures, made keyless with
the release workflow's GitHub OIDC identity, so there is no long-lived
signing key to hold or rotate. Each image also carries a per-platform SPDX
SBOM attached to its index, readable without pulling the image.

Images are signed by digest, not by tag. buildx records the digest it
pushed via --metadata-file and the signing script reads it from there:
signing a tag would sign whatever that tag resolves to when cosign runs,
which is not necessarily what the run built. --recursive covers the
per-platform manifests inside the index as well, so a verifier that has
already resolved to a platform-specific digest still finds a signature.

The signing script derives its work list from the build metadata directory
rather than from a list of image names. A hand-maintained list can drift
from what is actually built and publish an unsigned image while the job
still exits 0 - the same failure shape as a hardcoded chart version. The
complementary invariant, that everything a release should contain was in
fact built, stays with the verification step, which now also asserts the
SBOM is really attached and runs before anything is signed.

Both signing steps verify what they just produced and fail the release if
it does not check out: a signature nobody can verify is worse than no
signature, because RELEASING.md tells users to rely on it. The identity
those checks pin is bound to this workflow file rather than to the
repository, so another workflow that later gains id-token: write cannot
mint signatures that pass, and it carries no ref constraint so both tag
pushes and workflow_dispatch runs verify. RELEASING.md documents the
byte-identical pattern for consumers.

The CRD bundle's checksum is signed as a blob and its signature bundle
uploaded as a third release asset, which publish-release now requires
before it will publish.

Part of #693.

Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com>

…form

The cosign identity pattern ended immediately after "@", so it accepted
release.yml run from any ref. A workflow_dispatch runs the workflow
definition from the ref it was started on, which made "any branch in the
repository" part of the trusted set. Constrain it to release tags and the
main / release-X.Y branches.

Move the pattern and the OIDC issuer into hack/release/identity.sh, read
by both signing scripts and by their tests. The tests previously
reimplemented the pattern, so they asserted a copy and would have kept
passing after the scripts drifted.

Be explicit about what this does not buy: it bounds which workflow
definitions can sign, not who can sign. Someone with write access can
still push a v* tag at a commit carrying a modified release.yml, and the
tag arm accepts it. Closing that needs a ruleset restricting who may
create v* tags, which the repository does not have today.

Signing runs after the images are pushed, so a run from an untrusted ref
would have published three images, signed them, written a Rekor entry,
and only then failed verification. Add check-signing-ref.sh as the first
step of create-draft-release, which gates every publishing job: the same
identity is now tested before anything exists to clean up.

The SBOM gate inspected only linux/amd64 while the release promises one
per platform, so an image missing its arm64 SBOM would have published
behind a green check. Iterate the platforms instead, cross-checked
against the Makefile as a set so a narrowed RELEASE_PLATFORMS fails
loudly rather than narrowing the check to match. Capture buildx's stderr
too - a registry error and a missing attestation need different fixes and
were reported identically.

RELEASING.md claimed release.yml was the only workflow holding
id-token: write; squad-docs.yml has it as well.

Tests: 49 -> 76. Mutating the issuer, dropping the pattern's anchor,
widening setup-release.yml's tag grammar, or leaving one of the two
documented patterns stale each now fail the suite; before, all four
passed.

Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com>