Wire Sigstore release workflow

[scottconverse]

Summary

• wire the release workflow to generate, Sigstore-sign, and pre-publication-verify release-attestation.json
• add a reusable build_release_attestation helper plus CLI wrapper for workflow use
• extend release-preflight dispatch inputs so dry-runs can verify fixture-only and prepared-attestation paths

Not Release-Class Work

• no tags deleted, recreated, or pushed
• no GitHub releases created or modified
• no release notes edited
• no attestation generated against any real existing release
• no publication path executed from this branch

Verification

• python scripts\verify-release-provenance.py --fixtures-dir tests\fixtures\release_provenance — PASS, all 9 fixtures behaved as expected
• python -m pytest tests\test_release_provenance.py -q — PASS, 2 tests
• python -m ruff check civiccore\release_provenance.py scripts\build-release-attestation.py tests\test_release_provenance.py — PASS
• python -m pytest --collect-only -q — PASS, 247 tests collected
• git diff --check — PASS
• required docs gate — PASS (README.md, CHANGELOG.md, CONTRIBUTING.md, LICENSE, .gitignore, docs/index.html present)
• bash scripts/verify-release.sh — PASS, 247 tests + ruff + provenance fixtures + required docs + build + fresh-venv install

Post-Merge Dry-Runs Planned

• run release-preflight.yml with fixtures_only=true to prove known-good fixture acceptance and adversarial fixture rejection in Actions
• run release-preflight.yml against the current unauthenticated live release without attestation inputs to prove it fails closed before publication