[heidari-dev]

Closes #90

The sign job already runs actions/attest-build-provenance, but the attestation only lives in GitHub's store. Scorecard's Signed-Releases check wants a *.intoto.jsonl file among the release assets, so the job now copies the action's bundle-path output (one in-toto statement in a Sigstore bundle, covering every file in dist/) to kite-VERSION.intoto.jsonl. It is copied before the cosign step, so it also gets a .sigstore.json. check joins the job's needs for the version.

It is not in SHA256SUMS: the attestation is made from those digests, so it cannot be listed there (the .sigstore.json files are left out for the same reason). docs/releasing.md says so and shows gh attestation verify --bundle for offline checks.

Testing: dry run with workflow_dispatch from this branch, results in a comment below.

[heidari-dev]

Dry run from this branch (workflow_dispatch, run 43576979165) passed. release-files holds kite-0.1.0-rc.1.intoto.jsonl (one line, a Sigstore bundle whose in-toto statement is SLSA provenance v1 with 8 subjects) and kite-0.1.0-rc.1.intoto.jsonl.sigstore.json. gh attestation verify kite_0.1.0-rc.1_amd64.deb --repo heidari-dev/kite --bundle kite-0.1.0-rc.1.intoto.jsonl --signer-workflow heidari-dev/kite/.github/workflows/release.yml exits 0 on the real file and 1 on a file that is not in the release. The publish job only runs for tags, so the upload with gh release create dist/* is untested until the rc tag, but it already takes every file in dist/.