feat: tag-triggered publish pipeline with attestations

[jmgilman]

Summary

• Adds the four-part publishing pipeline: release.yml (tag entrypoint with verify → release → finalize jobs), reusable-release.yml (trusted builder), plus codeql.yml, dependency-review.yml, scorecard.yml for continuous security.
• Build provenance and SBOM attestations are pushed to GitHub's Attestations API via actions/attest@v4 (subject-checksums form for provenance, SPDX predicate form for SBOM). Only the Lambda zip ships as a release asset — no Cosign, checksum, or SBOM files are attached.
• Extends .github/dependabot.yml to cover gomod; existing github-actions + npm(docs) blocks unchanged.
• README gains a Verification section with gh attestation verify commands (online, SBOM-specific, and offline/air-gapped forms). New docs/docs/explanation/release-architecture.md documents the pipeline design and the rationale for the attestation-only verification channel.

Design rationale

Aligns with the refreshed publishing skill: separation of versioning from publication, trusted reusable builder (SLSA L3 signer identity distinct from caller), attestations-as-API-records rather than release-asset bundles. The tag entrypoint preflights release-please's draft release via scripts/wait-for-draft-release.sh and only un-drafts via scripts/publish-draft-release.sh after the reusable build succeeds, so any failure leaves the release invisible.

No Cosign step — GitHub Artifact Attestations is already a Sigstore keyless flow under the hood; adding cosign sign-blob would duplicate the signature and add a second key-management surface.

Test plan

• actionlint .github/workflows/*.yml passes
• python3 yaml.safe_load parses every new workflow and dependabot config
• bash -n syntax-checks on both scripts
• moon run broker:check passes (unit + build)
• moon run docs:build passes with the new explanation doc
• Tag workflow's real acceptance test: after this PR merges, merging release-please PR chore(master): release 1.0.0 #9 produces v1.0.0; release.yml must complete and gh attestation verify must succeed against the published zip. Fix forward via v1.0.1 if any step fails (tags are immutable).

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.