ci(release): consolidate release workflow with comprehensive signing

[aRustyDev]

Summary

• Consolidates all release logic into release-please.yaml workflow
• Removes redundant release.yaml that was causing race conditions
• Adds comprehensive signing for all release targets

Release Targets (All Signed)

Target	Signing Method
GitHub Releases	Cosign blob signature (.tgz.sig) uploaded to release
GHCR / GitHub Packages	Cosign keyless signing for OCI artifacts
Charts branch	Published via chart-releaser (signatures in releases)

Publishing Pipeline

1. chart-releaser - Creates GitHub Releases + updates charts branch
2. Sign Release assets - Cosign signs .tgz files, uploads .sig to releases
3. Push to GHCR - Helm push to OCI registry
4. Sign GHCR artifacts - Cosign keyless signing
5. Build attestations - SLSA provenance for all packages

Verification Commands

# Verify GHCR OCI artifact
cosign verify ghcr.io/arustydev/charts/<chart>:<version> \
  --certificate-identity-regexp="https://github.com/aRustyDev/helm-charts/.github/workflows/.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

# Verify GitHub Release asset
gh release download <chart>-<version> --repo aRustyDev/helm-charts
cosign verify-blob --signature <chart>-<version>.tgz.sig \
  --certificate-identity-regexp="https://github.com/aRustyDev/helm-charts/.github/workflows/.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  <chart>-<version>.tgz

Test plan

• Merge PR chore(main): release mdbook-htmx 0.2.1 #23 (release-please PR for mdbook-htmx 0.2.1) to trigger release
• Verify all 5 release steps complete successfully
• Confirm signatures present on GitHub Release and GHCR
• Test verification commands work

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying helm-charts with    Cloudflare Pages

Latest commit:	d6d7332
Status:	✅  Deploy successful!
Preview URL:	https://f9086250.helm-charts-76l.pages.dev
Branch Preview URL:	https://fix-consolidate-release-work.helm-charts-76l.pages.dev

View logs