epic: Atomic Release Pipeline Actions

## Overview

Extract atomic release pipeline functionality from `helm-charts` into reusable composite actions.

## Background

The atomic release pipeline in `helm-charts` (W1 → W2 → W5 → W6) contains generalizable logic for:
- Attestation management (extract, update, verify)
- Atomic branching (detect changes, create branch/PR)
- Version bumping (determine bump type, calculate version)
- Trust validation (source branch, CODEOWNERS)

## Goal

Create composable actions that any repo can use to implement an attestation-backed release pipeline.

## Action Inventory

### Attestation (`actions/attestation/`)
| Action | Issue | Priority | Status |
|--------|-------|----------|--------|
| `extract-map` | #23 | P0 | 📋 Open |
| `update-pr-map` | #24 | P0 | 📋 Open |
| `generate-digest` | #25 | P0 | 📋 Open |
| `verify-chain` | #26 | P1 | 📋 Open |

### Atomic Branch (`actions/atomic-branch/`)
| Action | Issue | Priority | Status |
|--------|-------|----------|--------|
| `detect-changes` | #27 | P1 | 📋 Open |
| `create-branch` | #28 | P1 | 📋 Open |
| `create-pr` | #29 | P1 | 📋 Open |

### Version Bump (`actions/version-bump/`)
| Action | Issue | Priority | Status |
|--------|-------|----------|--------|
| `determine-bump` | #30 | P1 | 📋 Open |
| `calculate-version` | #31 | P1 | 📋 Open |
| `update-manifest` | #32 | P2 | 📋 Open |

### Source PR (`actions/source-pr/`)
| Action | Issue | Priority | Status |
|--------|-------|----------|--------|
| `find` | #33 | P2 | 📋 Open |

### Trust Check (`actions/trust-check/`)
| Action | Issue | Priority | Status |
|--------|-------|----------|--------|
| `validate-source-branch` | #34 | P2 | 📋 Open |

### Changelog (`actions/changelog/`)
| Action | Issue | Priority | Status |
|--------|-------|----------|--------|
| `extract-version` | #35 | P2 | 📋 Open |

## Implementation Order

**Batch 1 - Core Attestation (P0)**
- [ ] #23 - `attestation/extract-map`
- [ ] #24 - `attestation/update-pr-map`
- [ ] #25 - `attestation/generate-digest`

**Batch 2 - Atomic Branch (P1)**
- [ ] #27 - `atomic-branch/detect-changes`
- [ ] #33 - `source-pr/find`
- [ ] #28 - `atomic-branch/create-branch`
- [ ] #29 - `atomic-branch/create-pr`

**Batch 3 - Version Bump (P1)**
- [ ] #30 - `version-bump/determine-bump`
- [ ] #31 - `version-bump/calculate-version`

**Batch 4 - Supporting (P2)**
- [ ] #26 - `attestation/verify-chain`
- [ ] #32 - `version-bump/update-manifest`
- [ ] #34 - `trust-check/validate-source-branch`
- [ ] #35 - `changelog/extract-version`

## Related Issues

- #13 - changelog generation (may be consolidated with #35)
- #15 - semver bumping (may be consolidated with #30, #31)
- #18 - W2 change detection (fixed in reusable workflow v0.1.1)

## Implementation Notes

- Actions should be pure and composable
- Use shell scripts for portability (no Node.js dependencies where possible)
- Follow GitHub Action best practices for inputs/outputs
- Include README with usage examples