Tweak staging invocation

[jku]

Main change here is the staging invocation: I'm proposing that a single action invocation only runs the testsuite once because

• xfails becames painful if staging expected failures are not the same as prod (which seems like a normal thing at times).
• The test results are much clearer ("Staging conformance failure" is not as critical as "production conformance failure")

Other changes in this PR (from testing and reviewing for a hopefully near future release):

• run selftest daily (and on dispatch)
• update linter config to silence warnings
• update cli protocol doc and move --staging so it's not after the artifact filename

Fixes #130

I'll mark William a reviewer since we originally agreed to run test suite twice but I think we may have been wrong.

---

For release Notes:

• The action now supports testing against Sigstore staging infrastructure: if your Sigstore client can be used with staging, please enable this by adding a second step to your workflow: see README

[woodruffw]

I'm proposing that a single action invocation only runs the testsuite once because

• xfails becames painful if staging expected failures are not the same as prod (which seems like a normal thing at times).
• The test results are much clearer ("Staging conformance failure" is not as critical as "production conformance failure")

Makes sense to me, thanks for documenting!