fix: Use sigstore-go TUF client for delegation-aware target retrieval

[k4leung4]

Summary

Refactor TUF client usage to use sigstore-go's tuf.Client for target retrieval, which correctly traverses TUF delegations.

• Introduce TUFClient wrapper providing:
  • GetTarget(): delegates to sigstore-go tuf.Client (delegation-aware)
  • GetTopLevelTargets(): lazy-initialized raw go-tuf v2 updater (legacy fallback only)
• The raw updater for GetTopLevelTargets is lazily initialized on first call, avoiding a double TUF metadata refresh when only GetTarget is needed (the common trusted_root.json path)
• GetTarget errors are properly distinguished: "not found" falls through to the legacy custom metadata path, while other errors (network, hash mismatch, corruption) are propagated immediately
• ClientFromSerializedMirror and ClientFromRemote now return *TUFClient
• Remove downloadTarget helper — replaced by tufClient.GetTarget()

Based on feedback from sigstore/sigstore-go#602.

Test plan

• go build ./... passes
• go test ./... passes (all 14 test packages)
• gofmt clean
• golangci-lint — no new issues
• Existing tests updated to use new TUFClient API

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 77.77778% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 30.32%. Comparing base (49e26b2) to head (771bc40).
⚠️ Report is 9 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/tuf/repo.go	86.00%	6 Missing and 1 partial ⚠️
pkg/reconciler/trustroot/trustroot.go	50.00%	3 Missing and 2 partials ⚠️
pkg/apis/policy/v1alpha1/trustroot_validation.go	33.33%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1947      +/-   ##
==========================================
+ Coverage   29.98%   30.32%   +0.33%     
==========================================
  Files         122      122              
  Lines        7323     7354      +31     
==========================================
+ Hits         2196     2230      +34     
+ Misses       4894     4892       -2     
+ Partials      233      232       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.