Adds GitHub-native build-provenance attestation via `actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be` (v2), mirroring the estate exemplar.

Attested artifacts

• Container image — `docker-publish.yml` job `build`: attests `ghcr.io/${{ github.repository }}` by push digest, pushed to registry. Gated on non-PR events (matches the push gate; no empty-digest run on PRs).
• Container image — `ci.yml` job `docker-build`: attests `ghcr.io/${{ github.repository }}` by push digest, pushed to registry (runs on push to main/develop).
• Release assets — `ci.yml` job `release`: attests `economic-toolkit-excel.zip` and `dist/uno/economic-toolkit.oxt` (LibreOffice extension) by path.

Permissions

Added `id-token: write` + `attestations: write` to the relevant jobs (and `packages: write` where container push needs it; `contents: write` retained for the release job). `Build and push` steps gained `id: push` to expose the image digest.

YAML validated. Do not merge yet.