Attest build provenance for release artifacts

checksums.txt was the only integrity signal for a release, and it was itself unsigned: someone downloading a Linux archive plus its checksum had no way to establish that either came from this repository. macOS binaries were signed and notarized, but nothing else was — for a tool that handles git credentials and is installed via brew and go install, that is a gap worth closing.

The release workflow now attests the archives and the checksum file with actions/attest-build-provenance, which records a signed statement tying each artifact to this repository and the workflow run that built it. Verification needs no key distribution:

gh attestation verify <file> --repo entireio/git-sync

This adds id-token and attestations write permissions to the release job, which the attestation needs for its OIDC identity, alongside the existing contents: write. The action is pinned by SHA like every other action here. The step runs after goreleaser, so a failure in it leaves a published release without provenance rather than blocking the release itself.

README documents the check next to the install instructions.

Not verifiable outside a real release: this path only runs on a tag push, so the first tagged release after this merges is what confirms it works end to end.