refactor: Move verify-release.sh to scripts directory

Moved from docs/sbom/ to scripts/ alongside install.sh/install.ps1
for consistency. Updated documentation links accordingly.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: backnotprop

docs/sbom/slsa-verification.md

@@ -7,10 +7,10 @@ SLSA Level 3 guarantees: non-forgeable provenance (signed by GitHub OIDC, not ma
 ## Quick Verification
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/eqtylab/cupcake/main/docs/sbom/verify-release.sh | bash
+curl -fsSL https://raw.githubusercontent.com/eqtylab/cupcake/main/scripts/verify-release.sh | bash
 ```
 
-Or download and run locally: [`verify-release.sh`](./verify-release.sh)
+Or download and run locally: [`scripts/verify-release.sh`](../../scripts/verify-release.sh)
 
 ## Manual Verification