Install cosign via sigstore binary, not apt

.forgejo/workflows/build.yml

@@ -87,9 +87,24 @@ jobs:
 
       - name: Install build tooling
         shell: bash
+        env:
+          COSIGN_VERSION: v2.4.1
         run: |
+          set -euxo pipefail
+          # podman, buildah, skopeo, jq come from Ubuntu repos.
           sudo apt-get update -y
-          sudo apt-get install -y podman buildah skopeo cosign jq
+          sudo apt-get install -y podman buildah skopeo jq curl ca-certificates
+          # cosign is NOT in apt - install the official binary from sigstore.
+          sudo curl -fsSL \
+            "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-amd64" \
+            -o /usr/local/bin/cosign
+          sudo chmod +x /usr/local/bin/cosign
+          # Verify everything is callable.
+          podman --version
+          buildah --version
+          skopeo --version
+          cosign version
+          jq --version
 
       - name: Build image
         id: build