fix CI action failures on PR 550

The Docker manifest merge workflow failed before execution because
`sigstore/cosign-installer@v4` is not a published major tag in that
repository. Pinning it to the current released tag keeps the workflow on
v4 code while using a resolvable action ref.

The Storybook visual job failed because committed baselines were created
from local macOS rendering while CI validates on Linux Chromium. Replace
the phase-one visual snapshot baselines with Linux-rendered images from
the failing run artifacts so the expected output matches CI's source of
truth.

Author: bgentry

.github/workflows/docker-riverproui.yaml

@@ -157,7 +157,7 @@ jobs:
         uses: oras-project/setup-oras@v2
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v4
+        uses: sigstore/cosign-installer@v4.1.1
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v6
@@ -445,7 +445,7 @@ jobs:
         uses: oras-project/setup-oras@v2
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v4
+        uses: sigstore/cosign-installer@v4.1.1
 
       - name: Resolve manifest digest
         id: resolve-digest