Harden GitHub Actions and attest release provenance

[sridharkalaibala]

Summary

• pin every third-party GitHub Action to a reviewed immutable commit
• require manual release rebuilds to run from the requested tag ref
• create GitHub/Sigstore provenance attestations for every primary future release download
• publish a concrete gh attestation verify command and state the limits: provenance is not code signing, an independent audit, or proof of safety
• add a weekly OpenSSF Scorecard workflow that publishes results through the official action and uploads SARIF to GitHub code scanning
• add release and Scorecard workflow contract tests

Validation

• npm test: 783 passed
• Scorecard workflow tests: 2 passed
• release manifest tests: 9 passed
• actionlint 1.7.12: passed
• release workflow YAML parse: passed
• all pinned action commit references resolve upstream
• git diff --check: passed

Deployment boundary

This PR remains draft. No public attestation or Scorecard result exists until these workflows are merged and run from the default branch. OpenSSF Scorecard is an automated heuristic, not an independent audit or proof of safety.