fix(sign): trust cosign's unsigned answer only when the registry lists no signature bundle

[teemow]

Closes #1237.

What

retagger sign verifies a digest before signing it and signs when the verify fails. The pre-check now

• logs the verify's error at debug level, with the reference and cosign's message;
• trusts cosign's "no signatures found" only once the registry confirms it lists no signature bundle among the digest's referrers (hasSignatureBundle, a filtered referrers listing with the credentials cosign uses). A listed bundle means cosign's lookup was throttled: the verify is retried with the usual backoff, up to cosignAttempts times;
• signs over another identity's signature without asking the registry (cosign's answer is faithful there), and fails the tag for any other verify error instead of signing blindly;
• counts the race between concurrent cosign processes refreshing the shared TUF cache (failed to persist metadata) as transient.

The retry loop of cosign() moved into retrying(), shared with the referrers listing. go-containerregistry is the new dependency for the listing.

Why

cosign v3 verify auto-detects the bundle format with one referrers listing and, when that listing fails for any reason, silently switches to the legacy signature-tag path, which reports the digest unsigned. The registry throttles referrers listings per identity (1000 per 60 s, TOOMANYREQUESTS); a sign-all pass with four workers trips that limit about every 80 s, and the four in-flight pre-checks then read "no signatures found" and sign the digests again. Reproduced with 36 concurrent verifies of signed digests: 235 of 261 failures were "no signatures found", 17 the explicit TOOMANYREQUESTS, the rest the TUF cache race.

Verification

• Unit tests: the pre-check against an in-memory registry with the referrers API (unsigned → signed, one listing; bundle listed → verify retried, no sign; another identity → signed, no listing; unrelated verify error → failed, one cosign call); the listing under throttling (retried); the artifact-type filter.
• After the merge: one sign-all pass; the skopeo-file jobs must report 0 signed for tags whose digest did not change. Result on sign: a failing pre-check verify is silent and re-signs the digest #1237.