ci: artifact attestation must not gate publishing

The v0.6.9 tag build got all the way through -- 15/15 wheels built, smoke test
passed -- then failed the whole publish job at the last hurdle:

  Failed to persist attestation: Feature not available for the
  GuillaumeLessard organization.

Build provenance attestation requires a public repository or GitHub Advanced
Security; this is a private org repo. Nothing reached PyPI as a result, purely
because of a supply-chain nicety that is unavailable on this plan.

Now conditioned on `github.event.repository.private == false`, so it resumes
automatically if the repo is ever made public, plus continue-on-error so a plan
or visibility change can never block a release again. The publish step itself is
unchanged and still uses trusted-publisher OIDC.

Author: qectorlab

.github/workflows/release-build.yml

@@ -231,7 +231,16 @@ jobs:
           "
           rm -rf /tmp/smoke_venv
 
+      # Build provenance requires a public repository or GitHub Advanced Security.
+      # On this private org repo the API returns "Feature not available for the
+      # GuillaumeLessard organization", which failed the whole publish job AFTER
+      # all 15 wheels had built and passed the smoke test. Attestation is a
+      # supply-chain nicety; it must not gate shipping. Conditioned on visibility
+      # so it resumes automatically if the repo is ever made public, and
+      # continue-on-error so a plan change can never block a release again.
       - name: Generate artifact attestations
+        if: ${{ github.event.repository.private == false }}
+        continue-on-error: true
         uses: actions/attest-build-provenance@v2
         with:
           subject-path: "dist/*"