Add Sigstore Cosign tool feed

[Copilot]

Adds 0install feed support for Sigstore Cosign, a container image and OCI artifact signing/verification tool.

New files

• utils/cosign.xml — Main feed with metadata; empty <group> (no implementations, populated via watch workflow)
• utils/cosign.xml.template — Release template covering 5 platform targets using single-binary <file> elements (same pattern as jq):
  • Linux-x86_64, Linux-aarch64
  • Darwin-x86_64, Darwin-aarch64
  • Windows-x86_64
• utils/cosign.watch.py — GitHub release watcher against sigstore/cosign, emitting version (with rc. normalized to rc), original-version (the raw tag, e.g. v3.0.5), stability (pre-release aware), and released fields

Download URLs use {original-version} to preserve the exact GitHub tag (including the v prefix):

https://github.com/sigstore/cosign/releases/download/{original-version}/cosign-linux-amd64
https://github.com/sigstore/cosign/releases/download/{original-version}/cosign-windows-amd64.exe

[bastianeicher]

Look at kubernetes/kops.watch.py and kubernetes/kops.xml.template. I'd like you take the pattern of replacing rc. with rc for the version while passing through the original version as original_version. Apply this same pattern to utils/cosign.watch.py and utils/cosign.xml. Handling just rcis enough, no need forbeta`, etc..

[Copilot]

Look at kubernetes/kops.watch.py and kubernetes/kops.xml.template. I'd like you take the pattern of replacing rc. with rc for the version while passing through the original version as `orig...

Done in a333132. The watch script now uses a convert() function that keeps original-version (e.g. v3.0.5) and strips the v + replaces rc. with rc for version. The template URLs now use {original-version} instead of v{version}.