docs: state the sign-before-tag invariant precisely (WOR-871)

The workflow pushes by digest, signs, THEN promotes human-readable tags.
'signed with cosign before publish' implied no registry artifact exists
before signing, which is not the invariant. Flagged by CodeRabbit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: oblangatas

docs/install-docker.md

@@ -5,7 +5,7 @@ description: "Pull a pre-built, signed multi-arch image from GHCR."
 
 # Install -- Docker (from GHCR)
 
-Pull a pre-built, multi-arch image from the GitHub Container Registry. No clone, no build. Every image is scanned with [Grype](https://github.com/anchore/grype) on both architectures and signed with cosign before publish. The release fails on any **fixable Medium-or-higher** vulnerability — the same bar a pull request has to clear.
+Pull a pre-built, multi-arch image from the GitHub Container Registry. No clone, no build. Every image is scanned with [Grype](https://github.com/anchore/grype) on both architectures, and cosign-signed before any release tag is promoted. The release fails on any **fixable Medium-or-higher** vulnerability — the same bar a pull request has to clear.
 
 "Scanned" is not "zero known CVEs". The image carries a small number of CPython vulnerabilities inherited from the base image that have no stable upstream fix, and each one is listed in [`.grype.yaml`](https://github.com/shacharm2/worthless/blob/main/.grype.yaml) with a written argument for why it is not reachable from the proxy and a date by which it must be re-examined. Read that file if you want to check our reasoning rather than take our word for it.