feat(ci): attest build provenance (#71)

Part of the estate attestation rollout: add GitHub-native
build-provenance attestation to the release pipeline.

Adds
`actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be
# v2` to the job that uploads release artifacts via
`softprops/action-gh-release`, attesting the exact same files. Grants
`id-token: write` + `attestations: write` (keeping `contents: write`) on
that job.

Attested paths:
- `release/*` (release job)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/release.yml

@@ -143,6 +143,10 @@ jobs:
     needs: [build-linux, build-macos, build-windows, build-lsp]
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
 
@@ -164,3 +168,8 @@ jobs:
           generate_release_notes: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-path: 'release/*'