fix(ci): actually verify the claw-ui signature in the weekly drift run

[sulthannauval]

The first real drift run (manually dispatched — it had never fired since being added) went red on one assertion:

PASS  claw-ui archive downloaded
PASS  claw-ui checksum verified
FAIL  claw-ui signature verified
...
17 passed, 1 failed

The bundle was fine. It built, and every offline-install assertion passed — snapshot taken, skill migrated, kubeconfig kept at 0600, console staged, skill loads. The check was the defect.

Cause

rantaiclaw ui install treats a missing cosign as a soft degrade: it warns and installs anyway (only a missing signature bundle fails closed). drift.yml never installed cosign, so the assertion could not pass on the runner — and had it somehow passed, it would have meant nothing, because nothing was verified. It passed locally only because this machine happens to have cosign at /usr/local/bin/cosign.

Second, smaller problem: pack-airgapped.sh's output is captured to a temp file, so CI printed FAIL with the reason nowhere on screen. Diagnosing it meant reasoning from outside the log.

Change

• drift.yml installs cosign (sigstore/cosign-installer@v3) so the signature is genuinely checked — that verification is the reason the weekly run exists, so weakening the assertion would have removed the value instead of fixing it.
• tests/airgapped-bundle.sh now demands cosign the way it already demands bun: exit 2 with a reason. The check can no longer pass without verifying, nor fail for a cause that isn't the artifact.
• When the assertion does fail, the relevant pack-airgapped.sh lines are printed.

Verification

• with cosign present: 18 passed, 0 failed, real claw-ui v0.3.14 fetch, ✓ SHA256 verified and ✓ cosign signature verified
• with cosign hidden from PATH: refuses up front — ✗ cosign is required — this check exists to prove the claw-ui artifact was signed, exit 2 (prerequisite, not a failed assertion)
• control: the pre-change test in that same cosign-less environment reproduces the CI result exactly — 17 passed, 1 failed
• shellcheck -S warning clean; drift.yml parses and its step list is as intended
• a dispatched drift run on this branch is the real gate — see the checks below

Worth noting separately

That run also reported RC_TAG: v0.18.2-alpha. rantaiclaw has moved on from the 0.16.4-alpha baked into the released v0.2.1 bundle, and the installers pass against it: installer-matrix 61/0, bundle-consistency 23/0, and the full offline install green. That is exactly the drift this workflow was added to surface, caught within days instead of eight minors later.

The auto-filed issue (#5) is the reporting path proving itself under a real failure rather than a stub. Closing it once this is green.

Risk and rollback

Low — CI and test only, no product change. Revert 1451df3.