release: use exact SBOM path

[katovpn]

Summary

• pass the exact tag-derived CycloneDX path to the SBOM attestation action
• keep the executable subject glob, which the action explicitly supports

Safety notes

• workflow-only correction; no application or server behavior changes
• the previous failed workflow published no release assets

Files changed

• .github/workflows/release.yml

Verification performed

• workflow YAML parsed and the tag template matches the generated versioned SBOM filename
• prior retry completed build, checksum, SBOM generation, and provenance attestation

Approval required

• merge before the final v0.4.3-preview retry