fix(release): refresh supply-chain tooling

[gnanirahulnutakki]

Summary

• upgrade Syft from v1.46.0 to stable v1.49.0 in CI and tag release
• upgrade Cosign from v3.0.6 to stable v3.1.2 in tag release
• synchronize executable pins with README and ADR-0009
• add a 9-assertion policy gate for cross-workflow pin consistency, installer bindings, documentation, and Cosign v3.1 deprecated flags

Security, operations, and cost

The selected releases repair SBOM interpretation, malformed-input panic, and Sigstore bundle behavior. No identity, permission, action commit pin, publication order, artifact graph, service, storage, egress, or recurring cloud cost changes. CI CPU duration may vary slightly, but the build and attestation count is unchanged.

Verification

• exact parent: ae2d28de2d7fc6e6661098d9b1bb07e1b9381cad
• Actionlint and ShellCheck
• focused release-tooling policy: 9 assertions
• real Syft 1.49.0, Cosign 3.1.2, and GoReleaser 2.17.0 binaries
• go mod verify
• govulncheck ./...
• make ci
• make e2e-isolation plus 100,000 fuzz executions
• make release-check with two independent distributions, SPDX SBOMs, Homebrew formula, and dual-architecture OCI layout
• make e2e-kind KIND=/Volumes/EXTENDED/MacData/tools/bin/kind
• README and ADR-0009 reviewed and updated

Primary sources

• https://github.com/anchore/syft/releases/tag/v1.49.0
• https://github.com/sigstore/cosign/releases/tag/v3.1.2

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9dad68c6-58e9-4ca3-ba63-bad174f0cb66

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gnanirahulnutakki/release-tooling-20260721

---

_{Comment @coderabbitai help to get the list of available commands.}