changes for cosign v3 compatibility

[ltagliaferri]

Problem

Cosign v3.0.2 removed support for --output-signature and
--output-certificate flags in favor of bundle format. Workflows were
failing with:

Error: must provide --bundle with --signing-config or --use-signing-config

Solution

Updated all cosign sign-blob commands to use bundle format:

cosign sign-blob <file> --yes --bundle=<file>.bundle

Files Changed

compile-docs.yml:

• Simplified 3 cosign commands to use --bundle only
• Created placeholder .sig/.crt files for backward compatibility
• Updated tar archive to include .bundle files
• Updated release artifacts to use .bundle
• Updated verification instructions for bundle format

compile-public-docs.yml:

• Simplified 2 cosign commands to use --bundle only
• Created placeholder .sig/.crt files for backward compatibility
• Updated release to include .bundle files

Why Placeholder Files?

The Dockerfile and some verification scripts still expect .sig/.crt files.
Created empty placeholders to maintain compatibility during transition. The
real verification data is in the .bundle files.

Backward Compatibility

• Tar archives include both .bundle files (real) and .sig/.crt (placeholders)
• GitHub releases include .bundle files
• Verification instructions updated to use bundle format
• Dockerfile continues to work (copies placeholder files)

[netlify]

✅ Deploy Preview for ornate-narwhal-088216 ready!

Name	Link
🔨 Latest commit	2865288
🔍 Latest deploy log	https://app.netlify.com/projects/ornate-narwhal-088216/deploys/6958a4bce881280008b1fc60
😎 Deploy Preview	https://deploy-preview-2877--ornate-narwhal-088216.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.