Sign provenance attestations with cosign attest #236

Follow-up to #227.

#227 attaches provenance (mode=max) and SBOM attestations via buildkit, signs the image manifest digest with cosign sign, and signs the per-platform SPDX SBOMs with cosign attest --type spdxjson (.github/workflows/publish.yml). The buildkit-attached provenance attestation is still not cosign-signed, so policy engines that verify attestation signatures before trusting the predicate (e.g. Kyverno extractPayload) cannot use it.

Per @acidghost in #227 (review): extract the provenance predicate per platform and run cosign attest --type slsaprovenance --predicate <file> "${IMAGE}@${DIGEST}", mirroring the existing SBOM attestation step.

Reference implementations:

• https://github.com/acidghost/hetdns/blob/5386892099205f6d17fef08dc7d3357ce48a0eeb/.github/workflows/release.yaml#L176
• https://github.com/acidghost/k8s-fs-sidecar/blob/44d08101fc9ac969ee7b65f9bc33031a3aeb8f70/.github/workflows/release.yaml#L114-L129