ci(release): attest release artifacts via build-provenance (DIR-12)

- Expand permissions block: add id-token: write, attestations: write,
  artifact-metadata: write alongside the existing contents: write
- Insert "Attest release artifacts" step (actions/attest-build-provenance@v3)
  between "Build plugin" and "Create release"; subject-path covers all three
  release assets (main.js, manifest.json, styles.css) via newline-list syntax
- Step ordering is load-bearing: attestation runs after build (artifacts on
  disk) and before gh release create (sidesteps immutable-releases timing edge)

Pinned @v3 (not @v2 as originally anticipated): v2 last updated June 2025,
one major behind; v3 (v3.2.0, Jan 2026) is current stable with identical
input contract. See 05-RESEARCH.md §6.1 for full deviation rationale.

actions/checkout@v3, actions/setup-node@v3, node-version 18.x, and --draft
are all preserved unchanged (purist path — DIR-12 diff kept narrow).

.github/workflows/release.yml

@@ -10,6 +10,9 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write          # required by attest-build-provenance to mint OIDC token
+      attestations: write      # required by attest-build-provenance to persist attestation
+      artifact-metadata: write # required by v3+ for artifact metadata storage records
     steps:
       - uses: actions/checkout@v3
 
@@ -23,6 +26,14 @@ jobs:
           npm install
           npm run build
 
+      - name: Attest release artifacts
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: |
+            main.js
+            manifest.json
+            styles.css
+
       - name: Create release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}