ci: publish a clean :latest tag, drop cosign signing

The package page showed a sha256 hash instead of a usable tag. cosign
pushes a separate artifact per build, tagged sha256-<digest>.sig, and
because it goes up after the image it was the newest entry. Sixty-odd
nightly runs had filled the listing with them.

Dropping the signing step leaves :latest visible. The tradeoff is real:
published images are no longer signed against the sigstore log. There's no
way to keep cosign and hide its artifacts, since GHCR renders them as
ordinary versions, so it's signing against a readable package page.

Also makes the tagging explicit instead of relying on the action default.
latest=auto moves :latest onto any pushed vX.Y.Z tag.

Version goes to 2.0.0: storage moved to a new key format, migrated on
first open, and Backspace no longer deletes.

Removes the analytics tag from index.html.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "negotium-todo",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "A clean, minimal to-do list application with smooth animations and dark/light mode support",
   "type": "module",
   "main": "index.html",