CI: sign release artifacts (dry run)

[flyingrobots]

Add job to produce detached signatures for artifacts.

[flyingrobots]

Closing from the 2026-07-03 issue fate audit. This is pre-current-roadmap planning residue and no longer carries a current Echo-owned executable claim. Reopen or recreate only if it is recast as a narrow Echo issue with a fresh witness.