Attest the five release binaries with GitHub build provenance #100

Problem

The five binaries attached by .github/workflows/release.yml have checksums,
but GitHub does not publish attestations that bind those binaries to this
repository and release workflow.

npm package provenance requires no workflow change. The public
@executablemd/* packages already publish from this public repository through
npm Trusted Publishing/OIDC, and npm automatically generates provenance for
that path. npm publish --provenance is intentionally not added.

Scope

• Grant id-token: write and attestations: write to release.yml while
  preserving contents: write.
• Run a commit-SHA-pinned actions/attest@v4 step after each matrix compile and
  before artifact upload.
• Attest dist/${{ matrix.artifact }}, producing one attested subject for each
  of the five release binaries.
• Keep the binary files, artifact names, checksum generation, and GitHub Release
  contents unchanged.
• Document npm's automatic trusted-publishing provenance and binary verification
  with gh attestation verify.
• Add workflow regressions for permissions, the pinned attestation action,
  subject path, compile/attest/upload ordering, five-target coverage, and the
  release job's dependency on the build matrix.

Out of scope

• npm, JSR, or generated package-publishing workflow changes
• --provenance on npm publish
• SBOM, custom-predicate, OCI/registry, or checksum-file attestations
• attaching attestation bundles as release assets
• macOS/Windows code signing or notarization (macOS Developer-ID signing + notarization for xmd #68)
• runtime, Workspace, CLI, package, or executable-MDX changes

Acceptance

Every successful tagged build creates a GitHub-hosted build-provenance
attestation for each of the five raw compiled binaries before any matrix
artifact can reach the release job. An attestation failure fails that matrix
job, and release does not publish the binaries. A downloaded binary verifies
against this repository with:

gh attestation verify ./xmd-<target> -R taras/executable.md

References:

• https://docs.npmjs.com/trusted-publishers/
• https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations