Add per-binary attestations to release artifacts

## Problem

Release pages expose a release attestation, but individual release binaries do not currently have attestations that can be verified by digest. For example:

```console
$ gh attestation verify windows-amd64.exe --repo github/gh-aw
Loaded digest sha256:c9d426708181f5ba5749080c0b951a2bce6b5face914dd5cf01b25a0550e9012
Loading attestations from GitHub API failed: HTTP 404 Not Found
```

This makes it harder to establish that a specific downloaded executable was produced by the trusted release workflow, especially when investigating security-tool detections. Published checksums establish integrity against `checksums.txt`, but do not independently establish build provenance for each binary.

## Proposed change

Generate GitHub artifact attestations for every binary produced by `scripts/build-release.sh`, including each Windows, Linux, macOS, FreeBSD, Android, and WASM release artifact. Publish the attestations as part of the release workflow after building and before creating the immutable release.

## Acceptance criteria

- `gh attestation verify --repo github/gh-aw` succeeds for every binary attached to a release.
- The attestation identifies the trusted release workflow and source commit used for the build.
- Verification is covered by an automated release-workflow check for at least one artifact per supported platform family.
- Existing `checksums.txt` generation remains in place for straightforward integrity checks.