ci(release): automate Changesets release, SBOM, image signing, and provenance #692

Parent epic: #679
Related version policy: #451

Context

Changesets are present, but the audited repository lacks an end-to-end release workflow producing verifiable artifacts, SBOMs, signatures/attestations, and provenance.

Objective

Create a least-privilege, reproducible release pipeline for packages/source artifacts and production images.

Scope

• Validate Changesets and version policy before release.
• Build/test from frozen lockfile and immutable pinned actions/images.
• Produce CycloneDX or SPDX SBOMs for source dependencies and container.
• Generate checksums and GitHub artifact attestations/SLSA-compatible provenance.
• Sign images/artifacts using keyless OIDC where supported.
• Publish only from protected tags/branches with environment approval.
• Add release notes, rollback/yank guidance, and verification commands.

Acceptance criteria

• Pull requests verify required Changesets according to policy.
• Tagged release maps to source commit, version, checksums, SBOM, and image digest.
• Workflow permissions are minimal and third-party actions pinned by commit.
• Consumers can verify signature/attestation without repository secrets.
• No secret is printed or embedded in artifacts.
• Dry-run/rehearsal path is documented and tested before first production release.