docs: put pull, verify and changelog links on the release page and in README

The v1.25.19 release page carries only the CHANGELOG section: no pull command, no verify snippet, and no changelog link. README sent readers to SECURITY.md for cosign commands the site already shows inline, and the badge row showed no release version and no signed status.

scripts/tag-release.sh now appends a fixed "Get it" footer after the CHANGELOG section: the six image references, a docker pull line for the default variant, the cosign verify block from SECURITY.md with the tag substituted, and a permalink to that release's CHANGELOG section, anchored as GitLab renders ## [vX.Y.Z] - date headings, checked against v1.25.19's live anchor.

README's Verification section now inlines those same three commands, in SECURITY.md's and the site's shape; SECURITY.md stays the long form and is linked. The badge row gains GitLab's release badge and a static "cosign signed, SLSA v1.0" shields.io badge. The pipeline badge stays on main, captioned: its ref is a path segment, not a query parameter, so it cannot track the latest tag.

check-versions.sh and shellcheck both pass.