ci(release): attest build provenance for main.js and styles.css

actions/attest-build-provenance@v2 step 추가.
- Sigstore에서 단기 서명 인증서를 발급받아 GitHub attestation store에
  자산의 빌드 출처(commit SHA + workflow run)를 게시
- id-token: write + attestations: write permissions 추가
- 다음 release(1.0.1+)부터 자동 적용. 1.0.0은 retroactive 서명 불가

.github/workflows/release.yml

@@ -15,6 +15,11 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      # Required by actions/attest-build-provenance to mint a signing
+      # certificate from Sigstore and publish the attestation to GitHub's
+      # attestation store.
+      id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@v6
 
@@ -28,6 +33,13 @@ jobs:
           npm install
           npm run build
 
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            main.js
+            styles.css
+
       - name: Create or update release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}