fix(ci) harden offline sigstore bundle verification

[bgentry]

The offline bundle verification step would fail when oras discover returned a referrers index with manifests=null.

To resolve this and further harden the publish flow, I implemented a separate script which:

• Extracts referrers prefetch + offline verification into scripts/ci
• Force-fetches subject + referrers via curl (custom header) before oras
• Retries discovery briefly and handles empty referrer sets safely

@brandur I'm going to test this manually with some prerelease tags prior to #482 to make sure the full release flow is working smoothly prior to cutting a real release tag.

[brandur]

Approving to get unblocked, but IMO this is starting to be a large amount of code that doesn't have any testing and doesn't have any easy capacity to be tested besides pushing prerelease tags. It'd be nice if there was some way to get some basic exercise of it locally so we could vet changes more easily.

[bgentry]

@brandur I agree it's frustrating to not be able to test more of this locally. On the other hand we don't actually need to make prerelease tags to test it in CI, we just need to update the triggers here to include pushes to other branches:

riverui/.github/workflows/docker-riverproui.yaml

Lines 3 to 11 in 3dbbdbc

	on:
	push:
	branches:
	- "master"
	tags:
	- "riverproui/v*"
	pull_request:
	branches:
	- "master"

This is how it typically goes with testing anything driven by GHA and is definitely never a fun way to iterate. I think the only way to avoid that is to keep the pipeline itself just calling scripts/tools that can easily be tested independently, which would take some work here for sure.

[bgentry]

Ok, this fixed things! I made updates to the development.md docs as well. It seems clear to me that we will need to take a good look at how we can optimize all of our releases later this year, there are just too many moving parts across too many repos and new versions are too time consuming for us.