fix(ci): pin cosign-installer to a tag that exists

The helm chart publish failed on v0.2.2 with "Unable to resolve action
sigstore/cosign-installer@v4". Bumping it to a floating major was my
mistake: that project publishes v4 only as exact releases, and its newest
moving major tag is still v3, so v4 resolves to nothing.

Pinned to v4.1.2, the current release. This one needs a deliberate bump
rather than following a moving tag, because upstream does not offer one.

The binary release itself succeeded; only the chart publish failed, and it
can be re-run by dispatch once this lands.

Author: anmolnagpal

.github/workflows/helm-release.yml

@@ -64,7 +64,7 @@ jobs:
           echo "digest=${digest}" >> "$GITHUB_OUTPUT"
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@v4
+        uses: sigstore/cosign-installer@v4.1.2
 
       - name: Log in to GHCR (cosign)
         run: |