uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

Summary

The sigstore check on metadata.json is gated on the wrong side of the condition. LoadMetadata in internal/config/update.go:81 verifies the bundle only when UNIGET_IGNORE_METADATA_SIGNATURE is non-empty, so in a normal run, where nobody sets that variable, the signature is never checked. Setting the variable that is named "ignore the signature" is what turns verification on.

That matters because metadata.json populates Tool.Check, and pkg/tool/tool.go:250 runs Tool.Check through /bin/bash -c. That is the same sink as CVE-2026-45152, and the signature check added in v0.27.1 to close it is the control that no longer runs.

Where it is

internal/config/update.go:80-100:

func (c *Config) LoadMetadata(filename string) (loadedTools *tool.Tools, err error) {
	if len(os.Getenv("UNIGET_IGNORE_METADATA_SIGNATURE")) > 0 {
		_, err = security.VerifySigstoreBundle(
			filename,
			filename+".sigstore.json",
			...
		)
		if err != nil {
			return nil, fmt.Errorf("error verifying sigstore bundle for metadata: %s", err)
		}
	}

	loadedTools, err = tool.LoadFromFile(filename)