fix: attest release artifacts with build provenance

Obsidian's plugin scan flagged that the released main.js cannot be
independently reproduced from source. Add GitHub build-provenance
attestation (Sigstore-signed) so the released main.js/manifest.json/
styles.css can be cryptographically verified as genuine CI output from
this commit, regardless of byte-level build reproducibility:

    gh attestation verify main.js --repo iOSonntag/obsidian-plugin-treefocus

- add id-token:write + attestations:write permissions
- attest-build-provenance pinned by commit SHA, gated to real releases

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/release.yml

@@ -5,9 +5,11 @@ on:
     branches:
       - master
 
-# Least-privilege token; the release steps below need to push tags & create releases.
+# Least-privilege token.
 permissions:
-  contents: write
+  contents: write      # push the release commit/tag and create the GitHub release
+  id-token: write      # OIDC token for build-provenance attestation (Sigstore signing)
+  attestations: write  # publish the artifact attestation
 
 jobs:
   build:
@@ -84,6 +86,18 @@ jobs:
             --title="Release v$VERSION" \
             main.js manifest.json styles.css
 
+      # Build provenance: cryptographically attest (via Sigstore) that these exact
+      # artifacts were produced by this workflow from this commit. Lets users verify
+      # the release with `gh attestation verify main.js --repo <owner>/<repo>`.
+      - name: Attest build provenance
+        if: steps.chkVersion.outputs.NEXT_RELEASE_VERSION != ''
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        with:
+          subject-path: |
+            main.js
+            manifest.json
+            styles.css
+
       - name: Push Tag and staged Files
         if: steps.chkVersion.outputs.NEXT_RELEASE_VERSION != ''
         env: