ci: attest published images (multi-arch + SBOM + SLSA provenance)

Bring the publish workflow up to the same supply-chain standard as the
other ghcr.io/ppiova images: build linux/amd64 + linux/arm64, attach SBOM
and SLSA provenance, and push a keyless-signed build-provenance attestation
via GitHub OIDC. Adds id-token/attestations permissions, QEMU setup and
per-image build cache scoping.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ppiova

.github/workflows/publish.yml

@@ -12,6 +12,8 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write
+      attestations: write
     strategy:
       matrix:
         include:
@@ -22,6 +24,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - uses: docker/setup-buildx-action@v3
 
       - name: Log in to GitHub Container Registry
@@ -41,12 +46,23 @@ jobs:
             type=sha,format=short
             type=semver,pattern={{version}}
 
-      - name: Build and push
+      - name: Build and push (multi-arch)
+        id: push
         uses: docker/build-push-action@v6
         with:
           context: ${{ matrix.context }}
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=${{ matrix.image }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.image }}
+          provenance: true
+          sbom: true
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ghcr.io/${{ github.repository }}/${{ matrix.image }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true