fix: verify a fragment's signature before validating beside it

[ExtraToast]

The fragments validate-with-fragments pulls (#139) were read by tag and unverified. They only decide what validation accepts and are never packed, but a fragment pushed by anything other than this workflow could still change that.

• Pull by digest after verifying. Each one is now resolved to a digest, its keyless signature is verified against this workflow's identity (the same check push.sh reads its own push back with), and only then is it pulled, by that digest.
• cosign is installed before the step. It is installed once, before the pull, instead of after.

Follows a background security review of #139.