[FEATURE] Add SLSA compliance and cryptographic provenance to PyPI releases

Feature Area

Core functionality

Is your feature request related to a an existing bug? Please link it here.

NA - this is a proactive supply-chain security enhancement.

Describe the solution you'd like

Is your feature request related to a problem?

Currently, the release artifacts (dist/*) published to PyPI are not cryptographically notarized within the GitHub Actions pipeline. As agent frameworks become critical infrastructure, ensuring that the published wheels mathematically match the workflow run is vital to prevent supply-chain poisoning.

Describe the solution you'd like

Add a lightweight step to .github/workflows/publish.yml using ProofCore-Protocol/proofcore-action to compute SHA-256 digests of the dist/* files and anchor them to the blockchain via the existing OIDC identity (id-token: write).

I have already prepared the code and tested it. I will link the PR to this issue.

Describe alternatives you've considered

No response

Additional context

No response

Willingness to Contribute

Yes, I'd be happy to submit a pull request

Start by reading .github/workflows/publish.yml and the job that builds and publishes dist/* to PyPI, including its existing OIDC permissions. Done means the workflow uses ProofCore-Protocol/proofcore-action to compute SHA-256 digests and anchor the release artifacts through the stated identity, with the publish workflow still completing successfully.