Getting Started: `cosign` is required by the recommended path but not listed as a prerequisite

[trevor-vaughan]

Summary

The recommended install path uses cosign to verify the release, but cosign is not in the
prerequisites list and the page gives no install pointer for it.

Affected

• Page: content/docs/getting-started/_index.md (prerequisites at lines 27–36; cosign
  used at line 46)

Detail

The prerequisites list Git, Go, and Make. The recommended install path then invokes
cosign, which is not listed and was not present on a stock host. A reader on the
recommended path hits an unlisted dependency.

Suggested fix

Either add cosign to the prerequisites list with a link to its install instructions, or
present the signature-verification step as optional with its own dependency note. (See the
related issue on the cosign verify-blob command itself, which also needs correcting.)

---

Related: #59

Issue created with the help of Claude Opus 4.6