Add release workflow with build provenance attestations

Builds the plugin in CI on tag push and publishes the GitHub release with
attested main.js, manifest.json, and styles.css, addressing the artifact
attestation recommendation from the Obsidian plugin review.

.github/workflows/release.yml

@@ -0,0 +1,51 @@
+name: Release
+
+# Builds the plugin in CI and publishes a GitHub release whenever a version
+# tag is pushed (e.g. `0.1.3`). The build artifacts get provenance attestations
+# so users can cryptographically verify they were built from this repository.
+
+on:
+  push:
+    tags:
+      - "*"
+
+permissions:
+  contents: write
+  id-token: write
+  attestations: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            main.js
+            manifest.json
+            styles.css
+
+      - name: Create release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            --title "${GITHUB_REF_NAME}" \
+            --generate-notes \
+            main.js manifest.json styles.css