fix: supply chain hardening — sign SHA256SUMS, validate version inputs

[Jaro-c]

Problem

Three supply chain gaps:

1. SC-004: SHA256SUMS is not signed. An attacker who can replace the checksum file can direct installs to arbitrary binaries while the signature check passes.
2. SC-006 (install.sh): PODUP_VERSION is used in URL construction without format validation. A malformed value could redirect the download.
3. SC-007 (release.yml): The workflow_dispatch tag input is not validated for format before use. A typo or malformed tag would produce a broken release.

Fix

1. Sign SHA256SUMS with the Ed25519 key; upload SHA256SUMS.sig; verify in install.sh.
2. Add regex guard in install.sh: PODUP_VERSION must match ^v[0-9]+\.[0-9]+\.[0-9]+$ or be latest.
3. Add a validation step in the verify job that checks inputs.tag matches v[0-9]+.[0-9]+.[0-9]+.