bug: attestation map race condition in W1 parallel jobs

## Description

When multiple W1 jobs run in parallel (lint-test matrix, artifacthub-lint, changelog, commit-validation), they all try to update the attestation map in the PR description simultaneously. This causes race conditions where later updates overwrite earlier ones, resulting in incomplete attestation maps.

## Current Behavior

Only 1-2 attestations are stored in the map despite 6+ jobs generating attestations.

Example from PR #46:
```

```

Expected: All attestations from lint-test (x3), artifacthub-lint, commit-validation, changelog.

## Impact

- **W2-W4**: Low impact - these workflows can work with partial attestation data
- **W5, W7**: High impact - these workflows verify the complete attestation chain

## Proposed Solutions

1. **File-based locking**: Use `flock` to serialize updates (complex in parallel jobs)
2. **Sequential attestation job**: Single job at end that collects all attestation IDs from artifacts
3. **GitHub API with ETag**: Use optimistic concurrency control
4. **Matrix output aggregation**: Use `needs` and matrix outputs to collect all IDs first

## Acceptance Criteria

- [ ] All attestations from W1 jobs are stored in the PR description
- [ ] No attestations are lost due to race conditions
- [ ] Solution works with parallel job execution

## References

- W1 Workflow: `.github/workflows/validate-contribution.yaml`
- Attestation library: `.github/scripts/attestation-lib.sh`
- Plan: `.claude/plans/chart-release-workflows/workflow-1/plan.md` (Phase 1.7)