feat(ci): attest build provenance (#93)

Estate artifact-attestation rollout mirroring the proven exemplar.

Attested artifacts:
- Container image — `container.yml` (subject-name `${{ env.REGISTRY
}}/${{ env.IMAGE_NAME }}`, digest from the `Build and push` step,
push-to-registry).
- Release binaries — `release.yml` (`subject-path: release/*`, the
assembled release directory).

`publish.yml` deliberately skipped: its softprops step has no `files:`
input (ships no binaries), so there is nothing to attest there.

All steps use
`actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be
# v2` (SHA-pinned).

Author: hyperpolymath

.github/workflows/container.yml

@@ -16,6 +16,8 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write
+      attestations: write
     steps:
       - name: Checkout
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
@@ -37,6 +39,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=sha
       - name: Build and push
+        id: push
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v5
         with:
           context: .
@@ -46,3 +49,9 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+      - name: Attest container provenance
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

.github/workflows/release.yml

@@ -134,6 +134,8 @@ jobs:
     needs: [build-binaries, build-deb, build-rpm]
     permissions:
       contents: write
+      id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Download all artifacts
@@ -152,3 +154,7 @@ jobs:
           files: release/*
           generate_release_notes: true
           draft: false
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-path: 'release/*'