Export:  34ca2b7f5fa560b00c711a54c3cc76b1c212d7b3

Export:  09e06b23d81956581e5c4f1aa1489fe1704d020f

Export:  b3df5374b9c7ff18b4a856f04587a6e426310947

Export:  ce341670f395121d279456214efa06d269730420

Export mono/public/sdk: refs/heads/main

Export:  e48cbb365bc2e6db03a354b512ea109bbeb31eeb

Export:  744a93b82e2d43a8868906ebd1f946932d6ad34b

Export:  4a4ffe2e7c2818af1c9e8ad86921d47e70971a7e

The verify workflow was pinned to older protoc and protoc-gen-go versions
that no longer match what mono uses to generate the exported proto files.

## What

Update protoc (v29.3 → v34.0), protoc-gen-go (v1.34.2 → v1.36.11), and
protoc-gen-go-grpc (v1.5.1 → v1.6.1) in the verify workflow to match
mono's current codegen toolchain. Also add GitHub verified signature
support to .chainguard/source.yaml to allow direct PRs from GitHub users.

## Why

The stage-open-source export from mono regenerated *.pb.go files using the
newer tool versions, but this workflow's verify step was still pinning the
old versions. Re-running codegen locally produced different output, causing
the verify check to fail on every exported PR.

## Notes

- .github/workflows/ is excluded from mono's export, so this file must be
  kept in sync with mono/public/sdk/README.md manually going forward.
- No functional code changes — only CI toolchain version pins and signing policy.

Signed-off-by: jmeridth <jmeridth@gmail.com>

fix: sync codegen tool versions with mono

Export mono/public/sdk: refs/heads/main