Merge the "release/v2.1.6+node25.8.2" branch into the "maintenance/v2+node25" branch

This merge promotes `release/v2.1.6+node25.8.2` into `maintenance/v2+node25`, marking the next patch release on the Node.js 25 maintenance line. It consolidates one deployment workflow update in `.github/workflows/deployment.yml` that grants the release job the OIDC permission needed for signed BuildKit attestations and switches the multi-platform build step to explicit `attests:` entries with `mode=max`.

In the top-level `permissions:` block, the workflow now adds `id-token: write` so the job can mint the OIDC token required for attestation signing. In the `Build and push (multi-registry, multi-platform)` step, `provenance: true` is replaced with `attests:` entry `type=provenance,mode=max`, and `sbom: true` is replaced with `attests:` entry `type=sbom,mode=max`, leaving the rest of the build configuration unchanged.

No migration steps are required beyond updating to `v2.1.6+node25.8.2` on the `maintenance/v2+node25` line.

Author: Amnoor

.github/workflows/deployment.yml

@@ -36,6 +36,7 @@ permissions:
   contents: read
   packages: write
   deployments: write
+  id-token: write
 
 # Global environment variables used across jobs.
 env:
@@ -121,8 +122,9 @@ jobs:
           platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          provenance: true
-          sbom: true
+          attests: |
+            type=provenance,mode=max
+            type=sbom,mode=max
           cache-from: type=gha
 
       # Marking deployment as "success" if the workflow succeeds.