fix: resolve plugin review issues for attestation, deps, and lockfile

- Add GitHub artifact attestation for main.js in release workflow
- Pin @types/jest to exact version 29.5.14
- Commit bun.lock by removing it from .gitignore

.github/workflows/release.yaml

@@ -7,7 +7,9 @@ on:
             - "debug-*" # Also run on non-release debugging
 
 permissions:
-    contents: write # This gives permission to create releases
+    contents: write
+    id-token: write
+    attestations: write
 
 jobs:
     build:
@@ -36,6 +38,12 @@ jobs:
             - name: Build plugin
               run: bun run build
 
+            - name: Attest build provenance
+              if: ${{ !startsWith(github.ref_name, 'debug-') }}
+              uses: actions/attest-build-provenance@v2
+              with:
+                  subject-path: main.js
+
             - name: Verify versions match
               run: |
                   # Check if tag version matches package.json, manifest.json and exists in versions.json

.gitignore

@@ -19,5 +19,4 @@ main.js
 data.json
 
 # Exclude macOS Finder (System Explorer) View States
-.DS_Store
-bun.lockb
+.DS_Store

bun.lock

@@ -5,7 +5,7 @@
     "": {
       "name": "inboxer",
       "dependencies": {
-        "@types/jest": "^29.5.14",
+        "@types/jest": "29.5.14",
       },
       "devDependencies": {
         "@types/bun": "1.2.9",