ci(release): generate provenance in an isolated reusable workflow (SLSA L3)

[jmgilman]

Summary

PR 3 of 3 reproducing template-go-api's session-015 migration. Moves binary + image provenance attestation out of the build jobs into a new reusable workflow (.github/workflows/attest.yml). A reusable workflow has its own isolated OIDC identity, so the signing key is unreachable by the build's user-defined steps — that isolation is SLSA Build L3 (in-job attestation is only L2). Provenance still lands on GitHub's attestation API, so gh attestation verify keeps working; the signer-workflow is now attest.yml.

Changes

• New attest.yml (workflow_call): actions/attest for binary checksums + actions/attest-build-provenance for the image.
• release.yml: binary-release-assets uploads checksums.txt as an artifact (drops in-job attest + id-token/attestations perms); new attest-binaries / attest-image jobs call attest.yml. container-image-release keeps keyless cosign + the syft SBOM attestation in-job and drops the in-job provenance attest.
• ghd signer ripple → attest.yml: ghd.toml signer_workflow, stage_ghd_release_assets.py expected_signer (+ its test), and the inspection-summary gh attestation verify --signer-workflow. cosign's certificate-identity stays release.yml (the cosign signer is unchanged).

The three tag-only-path fixes, baked in from the start

These are the bugs the sibling's forced release shook out (the dry-run can't reach this path):

1. The shared attest job declares packages: write, so every caller — including the binary one — must grant it (a reusable workflow can't request more than its caller grants).
2. apko publish --sbom-path needs the dir to pre-exist → mkdir -p sbom (landed in PR2).
3. attest.yml carries its own docker/login-action — the build job's GHCR login doesn't cross the reusable-workflow boundary.

Validation

• actionlint clean on release.yml + attest.yml; stage_ghd test green (6/6, now asserting the attest.yml signer); moon run root:check green (12 tasks).
• The tag-only publish → cosign → attest path can't be exercised by the dry-run — it's validated by the throwaway-tag rehearsal after this merges (which is exactly how the sibling caught the 3 fixes above; they're pre-applied here).

🤖 Generated with Claude Code