[Test] Add local e2e coverage for OIDC keyless signing

[lgecse]

The local e2e suite only covers key-based signing 04_signature_test

The OIDC keyless (Fulcio/Rekor) sign+verify path — which exercises real dir logic (SignBlobWithOIDC/VerifyWithOIDC) — has no coverage.
Add an e2e test that signs a record keylessly and verifies it against the expected identity, wired to a self-hosted Sigstore stack and skipped when that stack isn't configured.

Acceptance criteria

• Keyless sign→verify is covered end-to-end against a self-hosted Sigstore stack.
• The test skips (not fails) when keyless isn't configured for the environment.