Add attestations to releases

At present you only publish checksum digests with your releases.

This is better than nothing, but not really good enough for the 2026 security environment where both integrity, authenticity and provenance of an artifact should be verified using cryptographically signed attestations.

Checksum digests only deliver on integrity validation, and relies entirely on the assumption that the checksum file itself is authentic and of good provenance. temporal only publish a simple plaintext checksum file, without even a signature attached.

This is perhaps even more important for temporal which operates at a critical core level of workflows.

Therefore please consider adding attestations to your release workflow, e.g. https://goreleaser.com/customization/publish/attestations/