chore(ci): add cosign signing and provenance attestation to multi-OS release workflow

[Ludy87]

Motivation

• Move signing to Cosign v3 bundle output so signatures are produced as Sigstore-compatible bundles.
• Ensure provenance and attestations are published alongside release artifacts for supply-chain verification.
• Provide the necessary GitHub Actions permissions to allow attestation and OIDC-based signing.
• Upload signature bundles and provenance files with release artifacts so downstream tools can find them.

Description

• Install cosign via sigstore/cosign-installer@v3.7.0 and sign artifacts using cosign sign-blob --bundle to write .sigstore.json files.
• Replace the previous *.sig/*.pem outputs with ./artifacts/**/*.sigstore.json in the softprops/action-gh-release files list and include ./artifacts/**/*.intoto.jsonl.
• Add an inline Python step that computes SHA-256 digests for artifacts and writes artifacts/provenance.intoto.jsonl containing an in-toto/SLSA provenance statement.
• Add job permissions attestations: write and id-token: write and run actions/attest-build-provenance@v2 with the artifact subject-path patterns.

Testing

• No automated tests were executed because this is a workflow-only change.

---

Codex Task

[Copilot]

Pull request overview

This pull request modernizes the release signing workflow by migrating from legacy signature formats to Sigstore-compatible bundles. It introduces cosign v3 bundle-based signing, generates SLSA provenance statements, and integrates GitHub's native attestation capabilities to enhance supply-chain security for release artifacts.

Key changes:

• Implements cosign bundle signing (.sigstore.json files) for all release artifacts using keyless OIDC-based signing
• Adds a Python script to generate custom in-toto provenance statements and integrates GitHub's attest-build-provenance action
• Updates the release workflow to upload signature bundles and provenance files alongside artifacts

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.