feat(ci): attest build provenance (#161)

## Estate attestation rollout

Adds GitHub native build-provenance attestation to
`.github/workflows/ghcr-publish.yml`.

**Push mechanism:** Podman (`podman build` + `podman push` to ghcr.io),
image `ghcr.io/hyperpolymath/verisimdb-api`.

**How the digest is obtained:** the SHA-tagged GHCR push now runs with
`podman push --digestfile=/tmp/ghcr-digest`, which writes the real
`sha256:...` digest of the pushed manifest. That value is exported as
the `push` step output and fed to the attestation as `subject-digest`.

**Changes:**
- Added a job `permissions` block with `id-token: write` +
`attestations: write` (plus the existing `contents: read`, `packages:
write`).
- Captured the pushed digest via `--digestfile`.
- Added an `actions/attest-build-provenance@e8998f94…` (v2, pinned) step
with `push-to-registry: true`, gated on the same non-PR condition as the
push.

Verify with:
```
gh attest verify oci://ghcr.io/hyperpolymath/verisimdb-api:<tag> --repo hyperpolymath/verisimdb
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/ghcr-publish.yml

@@ -30,6 +30,11 @@ jobs:
   build-and-push:
     runs-on: ubuntu-latest
     timeout-minutes: 60
+    permissions:
+      contents: read
+      packages: write
+      id-token: write       # mint the OIDC token the attestation is signed with
+      attestations: write   # write the build-provenance attestation (the "claim")
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
@@ -55,10 +60,26 @@ jobs:
           podman rm -f verisim-smoke
 
       - name: Push to GHCR
+        id: push
         if: github.event_name != 'pull_request'
         run: |
           SHORT_SHA="${GITHUB_SHA::12}"
           echo "${{ secrets.GITHUB_TOKEN }}" \
             | podman login ghcr.io -u "${{ github.actor }}" --password-stdin
+          # --digestfile records the real sha256 of the pushed manifest so the
+          # attestation binds to exactly what the registry received.
+          podman push --digestfile=/tmp/ghcr-digest "$IMAGE:$SHORT_SHA"
           podman push "$IMAGE:latest"
-          podman push "$IMAGE:$SHORT_SHA"
+          echo "digest=$(cat /tmp/ghcr-digest)" >> "$GITHUB_OUTPUT"
+
+      # GitHub native artifact attestation (build provenance) for the pushed
+      # image. Verify with:
+      #   gh attest verify oci://ghcr.io/hyperpolymath/verisimdb-api:<tag> \
+      #     --repo ${{ github.repository }}
+      - name: Attest container provenance
+        if: github.event_name != 'pull_request'
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-name: ghcr.io/hyperpolymath/verisimdb-api
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true