[Supply chain] Publish release SBOM and provenance attestations for the packaged action

[bjcorder]

Summary

Publish machine-readable SBOM, checksum, and provenance artifacts for semantic-version action releases.

Problem

The release workflow validates source, tests, and committed dist/, but downstream users do not receive a release SBOM or provenance artifacts that help them verify the packaged action contents behind a tag.

Proposed behavior

• Extend the semantic-version tag release workflow to produce release artifacts for the packaged action.
• Generate a CycloneDX SBOM for npm dependencies used by the packaged action.
• Generate a checksum manifest for action.yml, package-lock.json, package.json, and committed dist/* files.
• Publish GitHub artifact attestations for release artifacts where supported.
• Keep third-party release/SBOM/attestation actions pinned to full commit SHAs.
• Use least-privilege permissions needed for artifact upload and attestations.

Implementation notes

• Decide whether the artifacts attach to GitHub Releases, workflow artifacts, or both. Prefer the user-facing GitHub Release when available.
• Ensure the workflow still validates dist/ before creating attestations or publishing artifacts.
• Document how users can verify checksums and locate attestations.
• Keep this separate from moving the floating v1 major tag; v1 should still move only after semantic tag smoke passes.

Acceptance criteria

• A semantic-version tag workflow run publishes an SBOM artifact.
• A semantic-version tag workflow run publishes a checksum manifest covering action metadata and bundled output.
• Provenance/attestation artifacts are published or the issue documents why the selected GitHub plan/environment cannot support them yet.
• Release docs explain where artifacts are found and how to verify them.
• Workflow permissions are least-privilege and pass security hygiene checks.
• npm run format, npm run all, and git diff --check pass after workflow/doc changes.

Out of scope

• Changing action runtime behavior.
• Publishing package-manager registry releases.
• Moving the v1 tag automatically.