feat(ci): attest build provenance (#56)

Part of the estate attestation rollout: add GitHub-native
build-provenance attestation to the release pipeline.

Adds
`actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be
# v2` to the job that uploads release artifacts via
`softprops/action-gh-release`, attesting the exact same files. Grants
`id-token: write` + `attestations: write` (keeping `contents: write`) on
that job.

Attested paths:
- `artifacts/*.tar.gz`
- `artifacts/*.sha256`
(release job)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/release.yml

@@ -112,6 +112,8 @@ jobs:
     timeout-minutes: 15
     permissions:
       contents: write
+      id-token: write
+      attestations: write
     steps:
       - name: Download all artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -131,3 +133,9 @@ jobs:
           fail_on_unmatched_files: false
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-path: |
+            artifacts/*.tar.gz
+            artifacts/*.sha256