fix: return useful error instead of 500 when attestation verification raises

[mvanhorn]

Summary

A gem push with an attestation whose verification raises an unexpected error no longer returns a bare 500. Known Sigstore validation failures return a useful 422 with the specific message (as before), while unexpected errors from the verifier are reported for observability and return a generic, client-safe message rather than a raw exception dump.

Why this matters

Issue #6369 reports that pushing a gem with a bad/unexpected attestation can produce an opaque 500 with no actionable detail. The push path only rescued Sigstore::Error; anything else propagated as a generic server error, so a user with a malformed attestation just saw "500" and could not tell what went wrong.

This keeps the existing Sigstore::Error branch (specific, client-safe 422 validation message) and narrows a catch-all rescue to the Sigstore verifier call itself. An unexpected error there is reported via Rails.error.report(e, handled: true) and returned as a generic Attestation verification failed. message. Crucially, it does not leak the raw exception text to the public API and does not reclassify genuine server-side failures (policy setup, association, metrics) as client errors — those still surface as the normal 500.

Testing

Added pusher_test coverage: a known Sigstore::Error returns the specific validation message; an unexpected error during verification is reported, returns the generic message, and does not include the raw exception text. Note: the repo requires Ruby 4.0.5 / Bundler 4, which was not available in this environment, so the suite was not executed locally; the change is a small, self-contained rescue-scoping fix reviewed against the surrounding push flow.

Fixes #6369