Re-enable build provenance attestation now the repo is public #77

.github/workflows/release.yml has a commented-out actions/attest-build-provenance step. It was disabled on the first release because attestations are not available for user-owned private repositories, and the step failed with "Feature not available for user-owned private repositories" — after the image had already been pushed, so it failed the run without failing the publish.

The repository is public as of 2026-08-17, so the feature should now work.

To enable:

• Uncomment the step at the foot of the publish job.
• Restore attestations: write and id-token: write to that job's permissions, which were deliberately left out rather than granted for a step that did not run.

Verify it on a real release rather than assuming. The failure mode last time was the step running after a successful push, so a broken attestation does not mean a broken image — it means a red run and no provenance. Worth checking gh attestation verify oci://ghcr.io/jackcuthbert/fold:<version> once a release has cut.

Not urgent. Signed provenance lets someone pulling the image confirm it was built by this workflow from this repo rather than pushed by hand, which matters more as the image gets used.