fix(release): install minisign CLI fallback

[wgqqqqq]

Summary

• replace the broken cargo install minisign fallback introduced in fix(release): fall back when minisign apt package is unavailable #1759; the minisign crate is library-only and has no binary target
• on Linux, download the pinned official Minisign 0.12 archive, verify its SHA-256, and select the x86_64 or aarch64 executable
• on macOS, use Homebrew when minisign is absent
• remove Rust setup steps that existed only for the invalid Cargo fallback
• add an Ubuntu CI regression that forces package installation failure, exercises the download fallback, and executes the installed binary

Verification

• pnpm run check:github-config
• bash -n scripts/sign-release-assets.sh
• git diff --check
• inspected both official Linux binaries as statically linked x86-64/aarch64 executables

Local limitation

Docker is installed but its daemon is not running locally, so the Linux executable test is delegated to the new Shell Deploy Scripts Ubuntu CI step.