feat(action): attestation/verify-chain - Verify attestation chain

## Parent Epic
Part of #22 (Atomic Release Pipeline Actions)

## Priority
P1 - Security validation used by W5, W6

## Description

Create a composite action that verifies all attestations in a chain.

Iterates through an attestation map and verifies each attestation is valid and was created by the expected repository.

## Inputs

| Input | Required | Default | Description |
|-------|----------|---------|-------------|
| `attestation-map` | Yes | - | JSON object of check_name → attestation_id |
| `repository` | No | `github.repository` | Repository in owner/repo format |
| `token` | No | `github.token` | GitHub token for API access |

## Outputs

| Output | Description |
|--------|-------------|
| `verified` | "true" if all attestations valid |
| `total` | Total number of attestations checked |
| `passed` | Number that passed verification |
| `failed` | Number that failed verification |

## Usage Example

```yaml
- uses: arustydev/gha/actions/attestation/verify-chain@v1
id: verify
with:
attestation-map: ${{ steps.extract.outputs.map }}

- run: |
if [[ "${{ steps.verify.outputs.verified }}" != "true" ]]; then
echo "Attestation chain verification failed!"
exit 1
fi
```

## Source Reference

`helm-charts/.github/scripts/attestation-lib.sh`:
- `verify_attestation_chain()` (lines 195-248)

## Implementation Notes

- Try OCI bundle verification first, fall back to API
- Report detailed results for each attestation
- Fail fast on critical errors, continue on verification failures