fix(ci): add timestamp.sigstore.dev to egress allowlist (#365)

Cosign keyless signing uses timestamp.sigstore.dev for RFC 3161
timestamping, which was blocked by harden-runner egress policy.

🖥️ IDE: [Cursor](https://cursor.sh)
🔌 Extension: [Claude Code](https://claude.ai/download)


Model-Raw: claude-opus-4-6-20250514

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: nullvariant

.github/workflows/publish.yml

@@ -38,6 +38,7 @@ jobs:
             pkg-containers.githubusercontent.com:443
             registry.npmjs.org:443
             rekor.sigstore.dev:443
+            timestamp.sigstore.dev:443
             tuf-repo-cdn.sigstore.dev:443
             uploads.github.com:443