security: make release attestation a publication prerequisite #487

Goal

Ensure publication cannot proceed until the exact reviewed artifacts have provenance and SBOM attestations.

Scope

• Make the publish job depend on successful artifact attestation rather than running attestation and publication in parallel.
• Verify the attestation in the publication path against the exact artifact digest, repository, workflow, source commit, and release tag.
• Use the build job's source_commit and release_tag outputs for manual-dispatch verification instead of ambient GITHUB_SHA/GITHUB_REF.
• Preserve least-privilege permissions: only the attestation job receives attestations: write, and only the publication job receives PyPI OIDC.
• Add a failure-path test or workflow validation proving that missing/mismatched attestations block upload.

Acceptance criteria

• A missing, stale, or mismatched attestation prevents PyPI upload.
• Manual tagged publication verifies the same source identity as tag-triggered publication.
• Successful TestPyPI and PyPI rehearsals retain the existing release metadata and SBOM evidence.

This is a v1.0 supply-chain security gate.