fix(release): verify recovery attestation source

[chhoumann]

Summary

• expose the exact workflow source SHA from release provenance validation
• verify GitHub attestations against that workflow source SHA and ref
• keep the built release commit independently pinned by the validated release context, version-file contract, checkout, tag, and payload metadata

Failure reproduced

Recovery run 29079826974 correctly used the reviewed workflow from refs/heads/master while rebuilding release commit 79c6421334caae9c9ec3fa97620e49ae2dad95c9. The attestation verifier still required the release commit as its source digest, so it selected the earlier release-run/2.17.4 attestation and rejected the master source ref before publication.

Validation

• git diff --check
• npm run format:check
• Ruby YAML parse of .github/workflows/release.yml
• npm run test -- scripts/release-contract.test.ts scripts/release-plan.test.ts (28 tests)

Recovery

After merge, rerun release.yml from protected master for release PR #259. The verifier will bind attestations to the exact reviewed master workflow commit while the release payload and tag remain bound to the original 2.17.4 merge commit.

[cloudflare-workers-and-pages]

Deploying podnotes with    Cloudflare Pages

Latest commit:	2497033
Status:	✅  Deploy successful!
Preview URL:	https://682227a9.podnotes.pages.dev
Branch Preview URL:	https://fix-release-recovery-attesta.podnotes.pages.dev

View logs