Problem

Release checksums.txt files are not GPG or Sigstore signed. For a security tool, this is a meaningful gap — users have no way to verify binaries weren't tampered with after CI built them.

Fix

Add cosign signing step to .github/workflows/release.yml. Sign checksums.txt with a keyless Sigstore signature and attach the .sig and .bundle files to the release assets.

Verification instructions should be added to the README and install docs.