Sigstore/Rekor publishing for AUR push events