Attest exact release provenance

[biru-codeastromer]

Summary

• add pinned GitHub artifact provenance for the checksummed wheel and source archive
• bind verification to the exact signer workflow, signer commit, protected tag ref, and source commit
• verify each distribution before draft publication and again on published-release reruns
• retain exact remote asset closure and immutable release verification

This supersedes #25 with a clean linear history stacked on #36.

Validation

• make release-gate
• 111 passed, 1 optional skip, 91.83% coverage
• clean wheel installation, dependency audit, example, repository audit, and full-history secret scan passed

[biru-codeastromer]

Superseded by #39, which preserves the provenance contract on the repaired linear stack.