Ironflow v0.22.0

Patch re-release after v0.21.0 was reverted (#952). Pure CI / docs fixes — no engine or SDK changes.

Fixes

• Release pipeline: pin cosign sign-blob to legacy bundle format (#953).
• CI: pin sigstore/cosign-installer to v4.1.2 (#951).

Documentation

• Single H1 per page enforced across docs (#954).