Harden CLI distribution trust

[gauravtiwari]

Summary

• sync the hardened installers and public security policy from boringcache/monorepo#111
• verify signed checksum bundles automatically when cosign is present and preserve fail-closed strict mode
• pin public boringcache/one examples to the immutable v1.13.99 distribution commit
• add a SHA-pinned PR verification workflow, shared installer trust fixtures, and Dependabot configuration
• document checksum, Sigstore, source/distribution, and private vulnerability-reporting boundaries

Verification

• Verify distribution is green on this PR
• shell syntax and installer trust fixture checks pass for both installers
• public/source installer, install page, workflow, fixtures, Dependabot config, and security policy copies are aligned
• real v1.13.99 SHA256SUMS.bundle verifies with the exact release-workflow identity
• public docs contain no remaining boringcache/one@v1 examples

Repository controls applied

• GitHub Actions limited to GitHub-owned actions and immutable SHA references
• signed commits required on main
• Verify distribution replaces the post-merge Pages deployment as the required branch check

Depends on boringcache/monorepo#111.