feat(sign): sign the renamed images too

[teemow]

What

The retag-renamed-images job (retagger run, images/renamed-*.yaml) copied images to gsoci.azurecr.io without signing them: the sign step added in #1230 covered the skopeo files only, and the README said so. This closes the gap so that every image retagger copies to gsoci carries the CircleCI identity's signature:

• retagger run --sign signs each tag right after its copy to gsoci, through the same signTag as the skopeo path (same outcomes, same Done: summary; a copy that failed is not signed; a signing failure fails the run).
• retagger sign <renamed-images file> accepts a renamed-images file next to a skopeo file (told apart by the document's shape), resolving the destinations from the rules the way retagger run does and sharded by --executor-count/--executor-id. With the sign-all pipeline parameter the renamed job runs it over its share of the file: the one-off pass over the renamed tags mirrored before signing existed, with one worker per job (forty of these jobs share the registry's referrers rate limit).
• The renamed job's steps run with pipefail, so a signing failure fails the job instead of being swallowed by tee.
• Destination name and tag are computed in one place (DestinationName, DestinationTag) instead of three; copyImage reports its error so a failed copy is not signed. A copy error is still logged and not fatal, as before.
• README: the renamed images are signed; what stays unsigned is the Aliyun copies and the Trivy vulnerability databases (OCI artifacts no pod runs).

Verification

• go test ./... (new tests: destination name/tag rules, DestinationReferences from a fake skopeo list-tags, renamed-vs-skopeo file detection, executor sharding and invalid-rule reporting of governedReferences), golangci-lint run clean, circleci config validate and yamllint pass.
• Signing needs the job's OIDC token, so the live proof is the build_retag run on main after the merge (retagger run --sign in every retag-renamed-images job) and one sign-all pipeline over the renamed files; the result (cosign verify of a renamed tag mirrored before this change) is posted on mirror the KServe serving images and sign every mirrored digest #1227.