add artifact attestation for main.js and styles.css

Attests build provenance via actions/attest-build-provenance@v2 for both
release assets, addressing the Obsidian portal security recommendation.
Requires id-token:write and attestations:write permissions (added).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -54,6 +56,14 @@ jobs:
         if: steps.check.outputs.exists == 'false'
         run: npm run build
 
+      - name: Attest build provenance
+        if: steps.check.outputs.exists == 'false'
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            main.js
+            styles.css
+
       - name: Tag and create release
         if: steps.check.outputs.exists == 'false'
         env: