feat: Add GitHub Attestation, prepare for signed releases

[Kyle Gospodnetich (KyleGospo)]

Currently the prod action is missing a referenced workflow and gated by if:false, but this gets it in position for future signed releases.

Additionally, adds GitHub attestation to the container build step so that it's visible in the GitHub UI and done after signing.

[Copilot]

Pull request overview

This PR updates the GitHub Actions release and container-build workflows to support future signed releases by adding artifact signing for release packages and publishing build provenance attestations for container images.

Changes:

• Update the prod release workflow to download signed artifacts via pattern matching, sign .deb artifacts with cosign, and upload .sigstore.json bundles with the release.
• Update the container build workflow to publish GitHub attestations for image build provenance (after signing) and grant the workflow the required permissions.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/prod.yml	Downloads signed artifacts via pattern, signs .deb packages with cosign, and includes .sigstore.json bundles in the GitHub Release assets.
.github/workflows/build-containers.yml	Adds attestation-related permissions and an actions/attest step to publish container build provenance to the registry.