Skip SBOM attestation (schema validation fails), keep as release asset

Author: DeusData

.github/workflows/release.yml

@@ -447,11 +447,10 @@ jobs:
           json.dump(sbom, open('sbom.json', 'w'), indent=2)
           "
 
-      - name: Attest SBOM
-        uses: actions/attest-sbom@10926c72720ffc3f7b666661c8e55b1344e2a365 # v2
-        with:
-          subject-path: '*.tar.gz'
-          sbom-path: 'sbom.json'
+      # Note: SBOM is included as a release asset (sbom.json) but not
+      # attested via attest-sbom — our minimal CycloneDX doesn't pass
+      # the strict schema validation. Build provenance attestation
+      # covers binary integrity; SBOM provides dependency transparency.
 
       # ── Sigstore cosign signing ──────────────────────────────
       - name: Install cosign