fix(update): run the exact cosign the trust guard approved

[indaco]

Description

mt version update could check a release signature with a cosign the trust guard never approved. The guard vetted one binary and the spawn resolved another, so a shim dropped inside malt's own prefix - a directory every installed package can write to - could rubber-stamp the update. The guard now hands the resolved path straight to the spawn, and a candidate it cannot resolve is skipped rather than trusted.

Related Issue

• None

Notes for Reviewers

• A cosign reached through a symlink is now executed by its resolved target rather than the link. That is deliberate: the link is what an attacker in the prefix would control.
• The guard walks past a candidate it cannot resolve instead of refusing outright, so a transient filesystem error on one PATH entry no longer fails an update that a later entry would have satisfied. Skipping stays safe because the spawn only ever runs a candidate this walk returned and vetted.