fix(operator): verify module signatures with cosign v3

[ValgulNecron]

Before: the operator verified module signatures with github.com/sigstore/cosign/v2 v2.6.5. govulncheck (spec 013 G1, #673) reports two advisories reached from operator/internal/verify/verify.go that have no v2 fix: GO-2026-4529 in cosign/v2 itself, and GO-2026-5932 in golang.org/x/crypto/openpgp, which cosign pulls in.

After: the operator uses github.com/sigstore/cosign/v3 v3.1.2, the same cosign release that publish-edge and release already sign with.

The pkg/cosign, pkg/oci/remote and pkg/signature APIs the verifier calls are unchanged in v3, so only the import paths and go.mod/go.sum move. Verification behaviour is unchanged; the existing verify unit tests and the module-verification e2e paths cover it.

How: go get github.com/sigstore/cosign/v3@v3.1.2, rewrite the three imports, go mod tidy. Local check: go build ./... and go vet ./internal/verify/ compile clean. x/crypto/openpgp is still linked through rekor's PGP type; whether govulncheck still finds it reachable shows on #673 once this merges and master is merged into it (this PR's CI has no govulncheck job yet).

Spec 013 T021. #673 (the govulncheck gate) merges after this.

🤖 Generated with Claude Code

---

Generated by Claude Code

---

Generated by Claude Code

Summary by CodeRabbit

• Chores
  • Updated the underlying components used to verify signed artifacts, including a move to a newer major version of the verification software.
  • No changes to public interfaces or user-facing behavior are included in this update.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: GameplanePanel/Gameplane/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 79c679e0-7fd2-45c2-86a1-0c8fa0c9ecf5

---

📥 Commits

Reviewing files that changed from the base of the PR and between 798b295 and e043774.

---

⛔ Files ignored due to path filters (2)

• go.work.sum is excluded by !**/*.sum
• operator/go.sum is excluded by !**/*.sum

---

📒 Files selected for processing (2)

• operator/go.mod
• operator/internal/verify/verify.go

---

 _____________________________________
< No code too small, no bug too tall. >
 -------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[ValgulNecron]

web failed on e043774 in src/components/CaptureWidget.test.tsx › "enables download button only for Completed captures". The first download button was still disabled when the test asserted on it. The other 2760 tests passed.

This PR changes only operator/ Go code. web is green on master (run 38284594065). The test checks not.toBeDisabled() right after findAllByLabelText, without waiting, so a slow render on a busy runner can catch the button before it becomes enabled. This is the same kind of web timing failure that hit #677 and #678 in Share.test.tsx. No fix exists yet, and changing the test needs the maintainer's sign-off. I'm re-running the failed job once.

---

Generated by Claude Code

[github-actions]

CI Report - e043774

run 38285390059 - attempt 2

0 failed - 25 passed - 1 skipped - unknown elapsed

Coverage

Module	Measured	Gate	Margin
web	L95.48 S93.97 B88.66 F91.78	L92 S92 B82 F76	+1.97

Changed

Area	Files	+/-
operator/	3	+54/-51
(root)	1	+1/-0

Slowest jobs

no job duration data available

e2e buckets run

bot-fast