feat(ci): attest build provenance (#39)

Estate attestation rollout: add GitHub-native build-provenance
attestation (actions/attest-build-provenance@v2, pinned) to the release
workflow, attesting the SAME artifacts uploaded by
softprops/action-gh-release.

Attested path(s): _build/prod/rel/safe_brute_force/*.tar.gz

Pinned:
actions/attest-build-provenance@e8998f9
# v2

Author: hyperpolymath

.github/workflows/ci.yml

@@ -316,6 +316,10 @@ jobs:
     timeout-minutes: 10
     needs: [test, coverage, security, rsr-compliance]
     if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
 
     steps:
       - name: Checkout code
@@ -342,6 +346,11 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-path: '_build/prod/rel/safe_brute_force/*.tar.gz'
+
   ###########################################################################
   # Notify
   ###########################################################################