Sign build provenance for release packages

[Commanderx-code]

Change

Release packages had checksums but no signatures. SHA256SUMS is uploaded to the same release as the packages, so it catches a damaged download but not a release whose files were replaced. This PR adds signed SLSA build provenance to each package.

New attest job in linux-packages.yml:

• It runs only on tag pushes, and only after build, every install-deb, install-rpm and arch job passes.
• It downloads the packages and arch-package artifacts, rechecks their checksums, and signs provenance for the .deb, .rpm and Arch package using actions/attest v4.2.2, pinned to 1e69f48.
• It is the only job granted id-token, attestations and artifact-metadata write access. The build jobs stay read-only.

release:draft now checks each package before creating the draft. It runs gh attestation verify on every package and requires all of the following:

• the signer is this repository's .github/workflows/linux-packages.yml;
• the source ref is refs/tags/<tag>;
• the source digest is the tagged commit;
• the signing ran on a GitHub-hosted runner.

If any check fails, no draft is created. The release notes also tell users how to run the same check themselves.

Docs:

• docs/installation.md shows how to verify a downloaded package with gh attestation verify.
• docs/releases.md describes the attest job and the new check in release:draft.

Validation

• npm run check: passed.
• npm test: 78 passed.
• node --check scripts/release-draft.mjs: passed.
• The workflow YAML parses. gh 2.101.0 supports every verify flag used.
• This PR's CI confirms the workflow is valid, including the new job-level permissions. It cannot run the attest job, because that job runs only on tags. It will run for the first time on the next release tag, and release:draft refuses to create a draft if that step fails.

Review notes

• Attestations start with the next release. v0.7.1 and earlier have none, so the installation docs say "0.7.2 and later".
• The attestation is signed after the install tests, in the same workflow run, over the exact files the draft publishes. The signer identity is the linux-packages.yml workflow at the release tag.

🤖 Generated with Claude Code