release: emit attestable SBOM

[katovpn]

Summary

• retain the CycloneDX serial number required by GitHub SBOM attestations
• continue publishing a versioned CycloneDX 1.6 document and checksum

Safety notes

• workflow-only correction; no application or server behavior changes
• previous failed workflows published no GitHub release assets

Files changed

• .github/workflows/release.yml

Verification performed

• local generator emitted bomFormat, specVersion, and urn:uuid serialNumber
• local output passes the exact field checks used by actions/attest
• workflow YAML parsed successfully

Approval required

• merge before retrying v0.4.3-preview