fix(ci): correct cosign-installer pinned commit SHA

The v3.5.0 pin pointed at 59acb623... which does not exist in
sigstore/cosign-installer, so the release workflow failed at job setup
(first triggered for v0.7.0, since the Cosign step was added after
v0.6.1 in #84). Repin to the real v3.5.0 commit 59acb6260d9c.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: peczenyj

.github/workflows/release.yml

@@ -28,7 +28,7 @@ jobs:
         with:
           go-version: stable
       - name: Install Cosign
-        uses: sigstore/cosign-installer@59acb623e2b6991341b1d1e8a7001d2d622ca219 # v3.5.0
+        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
         with: