docs: badges reflect the real install path, not an empty npm package

[askalf]

The README said "Not yet on npm" three lines below two badges that pointed at
npmjs.com — and @askalf/redstamp currently resolves to a 0.0.1 placeholder.
So the top of our most-visible security repo rendered npm v0.0.1 while the
project is at v0.7.2, and the downloads badge read from the same empty package.

Swapped both for badges that reflect how redstamp is actually installed:

• npm version → github/v/release (tracks the real version)
• downloads → a sigstore-signed-release badge (matches the documented
  tarball + gh attestation verify install path)

No text changes — "Not yet on npm" is still accurate and now the badges agree
with it. Nothing to re-verify beyond the rendered badge row.

[sprayberry-reviewer]

Deterministic approval — no LLM reviewed this diff.

Classified low-risk: docs-only (1 file(s)).

This repository requires an approving review before auto-merge can proceed, so this
approval exists to satisfy that gate without spending a full Code Reviewer execution
on a diff whose risk is provable from the file list alone. This approval satisfies ONLY
the review requirement — the merge still separately requires green CI, which this sweep
does not and cannot short-circuit.

Anything outside the docs allowlist, any major dependency bump, any non-Dependabot
dependency change, and any unknown diff keep the full reviewer path.