feat(ci): attest build provenance (#31)

## Summary

Adds GitHub-native build-provenance attestation
(`actions/attest-build-provenance@e8998f94…` # v2, SHA-pinned) to
`.github/workflows/ci.yml`, mirroring the estate's proven exemplar.

## Attested artifacts

- **Container image** (`docker` job): attests the pushed GHCR image by
`subject-digest` (`steps.push.outputs.digest`), with `push-to-registry:
true`. Gated on `github.event_name == 'push'` so it does not run with an
empty digest when nothing was pushed. Added a job-level `permissions:`
block (`contents: read`, `packages: write`, `id-token: write`,
`attestations: write`) and `id: push` to the Build-and-push step.
- **Release binaries** (`release` job): attests `dist/*` (the downloaded
build artifacts) via `subject-path`. Added `id-token: write` +
`attestations: write` to the existing `permissions:` (kept `contents:
write`).

## Validation

- `python3 -c "import yaml; yaml.safe_load(...)"` passes.
- Commit is SSH-signed (verified).

Do not merge without owner review.

Author: hyperpolymath

.github/workflows/ci.yml

@@ -244,6 +244,11 @@ jobs:
     timeout-minutes: 15
     needs: [detect, build]
     if: needs.detect.outputs.has_docker == 'true'
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -268,6 +273,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=sha
       - name: Build and push
+        id: push
         uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: .
@@ -276,6 +282,13 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+      - name: Attest container provenance
+        if: github.event_name == 'push'
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-name: ghcr.io/${{ github.repository }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
   # Release job (on tags)
   release:
     name: Release
@@ -285,6 +298,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     permissions:
       contents: write
+      id-token: write
+      attestations: write
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -298,3 +313,7 @@ jobs:
         with:
           generate_release_notes: true
           files: dist/*
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-path: 'dist/*'