ci: harden release pipeline

[shayyz-code]

Summary

• require v-prefixed release tags and generate GitHub artifact attestations
• pin generated and manually maintained GitHub Actions to immutable commits
• document the release checklist, credential boundaries, and follow-up security work

Verification

• dist generate --check
• dist plan --output-format=json --no-local-paths
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7
• cargo fmt --all -- --check
• cargo check --all-targets
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test
• mdbook build docs
• mdbook test docs
• oranda build

No release tag is created by this change.

Closes #19

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.