Restore update signing and fix release tag validation

[turinglambdaai]

Summary

• restore the missing glaze/signing implementation and cross-platform tests required by the update-signing CLI already present on main
• make updater CLI option parsing consume values correctly, reject unknown arguments, and support positional artifacts
• ensure password-bearing temporary files are always removed
• document Ed25519 publisher authenticity and the CLI workflow
• fetch the real remote tag object into an isolated ref before validating annotated release tags

Validation

• fresh linked package scope: raco test --package glaze (234 tests before the CLI additions)
• signing library and installed CLI: 17 tests passed, including tamper, wrong-key, encrypted-key, positional artifact, sign and verify
• isolated remote tag provenance simulation passed
• workflow YAML parsed successfully