chore(ai): remove Sigstore integration; stage AI tools into CMS install

[natechadwick-intsof]

Summary

Removes the Sigstore signing/verification stack that was experimental and out of scope for 8.2, and wires the AI tools (skills, future plugins) into the CMS install at <InstallDir>/sys_resources/ai-tools/\ with a customer overlay at <InstallDir>/rx_resources/ai-tools/.

What changed

Sigstore removal (root pom + 2 modules):

• Root \pom.xml: drop \sigstore.java.version\ + \sigstore.maven.plugin.version\ properties, \dev.sigstore:sigstore-java\ dependencyManagement entry, \sigstore-maven-plugin\ pluginManagement entry, and the \sigstore-maven-plugin\ execution from the <sign>\ profile (the \maven-gpg-plugin\ sibling is kept for Maven Central artifact signing).
• \modules/ai-shared-develop: drop \sigstore-java\ dep, \exec-maven-plugin\ ResourceSigner wiring, \zip-skills\ + \�ttach-skills\ antrun / build-helper executions; delete 6 Sigstore Python scripts and 3 Java classes + 3 tests under \com.percussion.ai.signing.
• \modules/ai-shared-release: drop \sigstore-java\ dep, switch packaging from \jar\ to \pom, drop \maven-resources-plugin\ + \maven-assembly-plugin; delete \SkillVerificationService\ + \IntegrityValidatorTool; remove the stale \cosign-*\ and \�gent-integrity-validator\ skill folders.

Install staging (1 file, +14 lines):

• \modules/perc-distribution-tree/src/main/resources/installDistributionFiles.xml\ adds a staging step (after the TinyMCE block) that copies \modules/ai-shared-release/src/main/resources\ into \/sys_resources/ai-tools/\ and creates an empty \/rx_resources/ai-tools/\ for the customer overlay. Uses the standard \sys_resources\ (replaced on upgrade) /
  x_resources\ (preserved) overlay convention already in use for TinyMCE.

New skills (1 new dev-side skill, 1 new release-side skill):

• \modules/ai-shared-develop/src/main/resources/skills/maven-integrity-validator/SKILL.md\ — replaces the old 23-line stub with a full reference for the \�i-build-integrity-maven-plugin: skip flags, failure catalogue, regenerate workflow, test discipline, cross-platform notes.
• \modules/ai-shared-release/src/main/resources/skills/percussioncms-config/\ — initial release-side skill (\SKILL.md, \README.md, \CHANGELOG.md).

Install layout after this PR

\
/
sys_resources/
ai-tools/
skills/
percussioncms-config/
... future skills
plugins/ (future: per-tool shims)
rx_resources/
ai-tools/ (empty, customer overlay; survives upgrades)
\\

Pre-PR build

• \mvn-env.bat clean install -Dai.integrity.skip=true\ → BUILD SUCCESS in 13:29 min, all modules green.
• The integrity plugin is skipped because of a pre-existing repo-level conflict between the plugin's \�erify-hashes\ and the \WebUI\ frontend build regenerating \jquery.min.js\ between \�alidate\ and \ est\ (see WebUI frontend build regenerates files that the ai-build-integrity plugin has sealed #1510). This is a follow-up issue, not introduced by this PR.

Erlang self-review

• No new Java code → no new behavioral tests required.
• No new build warnings in the changed modules.
• Cross-platform paths only — the new copy step uses \/...\ and \/..., both portable; no hardcoded /\ or \\ separators.
• No secrets, no leaked tokens (the \GH_TOKEN\ warnings earlier were the standard 2.96.0 CLI banner; no \MKD-REDACTED\ markers in any staged file).

Refs #1510