ci: attach GitHub build provenance (SLSA) to release artifacts

[scott]

Motivation

actions/attest-build-provenance@v1 is a one-step add to release.yml that gives signed, queryable build provenance for every released binary via gh attestation verify. Free security and free marketing — the audience already uses the gh attestation CLI surface.

Acceptance criteria

1. release.yml's build job gains a final step:

   - uses: actions/attest-build-provenance@v1
     with:
       subject-path: 'dist/gander-${{ matrix.target }}${{ matrix.goos == "windows" && ".exe" || "" }}'

   (Adjust the suffix expression once docs: add a man page (gander.1) #30 lands; for the current matrix, the suffix is empty.)

2. The build job's permissions: block adds attestations: write and id-token: write.

3. After a real tag push, gh attestation verify dist/gander-darwin-arm64 --repo gandermd/gander-cli exits 0 against a freshly downloaded artifact.

4. README "Releasing" or a new "Verifying a release" subsection briefly mentions gh attestation verify.

Notes

• Once ci: emit SHA256SUMS.txt alongside per-asset sidecars #32 / ci: sign release artifacts with cosign (keyless, OIDC) #33 land, gh attestation verify becomes a consumer of these assets too. No code change here, just a consistency benefit.
• Provenance is also surfaced via the GitHub UI for any release — useful for the eventual homebrew tap review.