chore(release): pin zipsign install to 0.2.1

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Entire-Checkpoint: 01M52QKH2QRPBMJVXY9T33MSAX

scripts/setup-zipsign.sh

@@ -9,7 +9,7 @@ fi
 if ! command -v zipsign >/dev/null 2>&1; then
 	# --locked: every zip release zipsign 0.2.1 can resolve against has been
 	# yanked, so a fresh resolution fails; the published Cargo.lock still resolves.
-	cargo install zipsign --locked
+	cargo install zipsign --version 0.2.1 --locked
 fi
 
 mkdir -p ~/.zipsign