feat: verify cosign signature in gander --upgrade

[scott]

Motivation

gander --upgrade currently trusts SHA256 hashes downloaded from the same host as the binary — fine over HTTPS, but no cryptographic guarantee that the release wasn't tampered with. After #32 starts signing SHA256SUMS.txt (transitionally the per-asset sidecars) with cosign, --upgrade should verify the signature before swapping the running binary. This is the upgrade-path counterpart to #32.

Acceptance criteria

1. New helpers in upgrade.go (or a new verify.go) — bundle the cosign blob-verification into the upgrade flow:
   • Fetch the signed target (SHA256SUMS.txt once ci: add windows-amd64 and windows-arm64 to release matrix #31 lands, otherwise the chosen asset's .sha256).
   • Fetch SHA256SUMS.txt.sig and SHA256SUMS.txt.bundle (or the per-asset .sig / .bundle in the transitional path).
   • Call cosign verify-blob with:
     • --certificate-identity-regexp 'https://github.com/gandermd/gander-cli' (or the action's workflow file URL)
     • --certificate-oidc-issuer-regexp 'https://token.actions.githubusercontent.com'
     • --bundle <bundle> and --signature <sig> as inputs.
2. runUpgrade calls the verifier before installBinary and aborts with a clear error on a non-zero exit (including printing the asset name and cosign verify-blob stderr).
3. On signature verification success, the chosen asset's hash is checked against the signed SHA256SUMS.txt (or .sha256 line) — same as today, but rooted in signed data.
4. verifySha256 continues to be the fallback for releases that pre-date this change; log a warning, do not fail, when SHA256SUMS.txt.sig is missing.
5. New tests in upgrade_test.go:
   • Happy path (signed, matching hash): succeeds.
   • Tampered signature: aborts with a clear error, leaves the existing binary untouched.
   • Missing signature on a release: falls back with a logged warning.
6. README "Upgrading an existing install" mentions signed checksums briefly.

Notes

• Consider whether to vendor cosign via cgo or shell out. Shell-out is the lighter dependency and matches the existing process model. Recommend shell-out to cosign verify-blob for v1; revisit if a pure-Go signer is desired for portability.
• The fallback in Clean up temp file on Ctrl+C / SIGTERM #4 is what lets us roll this out across an existing release without forcing every user to upgrade through a known-good version.