Remove sign/verify stubs in favor of cosign CLI

[jpower432]

Summary

The sign() and verify() functions in pkg/complypack/ are stubs that return "not yet implemented." Rather than finishing these, signing should use cosign sign in CI after oras push -- the standard tool for signing OCI artifacts, already used for release binaries.

Verification is moving to complyctl (the consumer side), where it applies to both Gemara policy bundles and complypacks via sigstore-go.

What to remove

• sign.go and sign_test.go
• verify.go and verify_test.go
• WithSigning(), WithKeylessSigning() and signing fields from packOptions in options.go
• WithVerification(), WithKeylessVerification() and verification fields from unpackOptions in options.go
• sign() call in Pack() (pack.go:106)
• verify() call in Unpack() (unpack.go:48)
• ErrSigningFailed and ErrVerificationFailed from errors.go

complypack becomes a pure pack/unpack library. No trust decisions.

Context

• complypack#63 (closed) originally tracked finishing the sigstore-go stub -- this issue supersedes that direction
• Implement sigstore-go verification for policies and complypacks complyctl#643 tracks verification implementation in complyctl
• get pulls policy bundles without verifying signatures (THR02 mitigation gap) complyctl#607 is the original THR02 mitigation gap issue