ci: attest release binaries

[dyoshikawa]

Summary:

• publish GitHub Artifact Attestations for every release binary from SHA256SUMS
• grant the release workflow the minimal attestation and OIDC permissions
• document provenance verification with GitHub CLI

Test plan:

• pnpm cicheck

Closes #2346

[dyoshikawa]

This cannot be merged as-is. The attestation action requires artifact-metadata: write, so the release workflow can fail when it reaches the provenance step. The current main branch already contains the same functionality with that permission and this branch now conflicts with main; please close this superseded PR or rebase it and retain the missing permission if further changes are needed.

[dyoshikawa]

actions/attest also requires artifact-metadata: write. Without it, the provenance step can fail at release time even though this PR CI passes. Please add the permission (as current main already does) before relying on this workflow.

[dyoshikawa]

Closing as superseded, following up on my review above.

main already attests the release binaries: publish-assets.yml carries artifact-metadata: write, attestations: write and id-token: write, and runs actions/attest@v4.2.0 against dist-bun/SHA256SUMS. Merging this branch would regress that — it lacks artifact-metadata: write, attests by subject-path instead of the checksums file, and reinstates the Takumi Guard setup step main has since dropped. It's 202 commits behind main and conflicting, so there's nothing left to rebase on the CI side.

The one piece that never landed is the "Verify build provenance" section for the installation guide. I've noted that on #2390 so it gets picked up there with the binary-name fix folded in.