docs: explain how to verify release downloads

[bobleer]

Summary

• add concise English and Chinese guides for verifying signed release downloads
• expose the guide immediately beside the root README download links
• pin the BitFun minisign public key instead of trusting a key downloaded beside the signature
• clarify that release .sig files are base64-wrapped minisign signatures, not Apple notarization/Developer ID or Windows Authenticode

Verification performed

Tested against the public v0.2.15 asset bitfun-cli-0.2.15-aarch64-unknown-linux-gnu.tar.gz:

• downloaded asset size: 36,846,117 bytes
• original asset: Signature and comment signature verified, exit 0
• changed the first byte from 0x1f to 0x00
• modified asset: Signature verification failed, exit 1
• git diff --check
• pnpm run check:repo-hygiene

Scope

This documents an existing release mechanism. It does not claim platform code signing, expand license claims, or change release/build behavior.

AI assistance

AI-assisted. Testing level: fully tested for the documented v0.2.15 CLI example and repository hygiene scope.