Add build provenance attestation

[kevinbackhouse]

This is better because it lets users verify the artifact with https://cli.github.com/manual/gh_attestation_verify

[Copilot]

Pull request overview

This pull request replaces Sigstore-based artifact signing with GitHub's native build provenance attestation, enabling users to verify published packages using the GitHub CLI (gh attestation verify). The change improves the security workflow by creating attestations before publishing artifacts, ensuring they're immediately available when packages are downloaded.

Changes:

• Added attestations: write permission to both publishing workflows
• Replaced sigstore/gh-action-sigstore-python step with actions/attest-build-provenance
• Moved attestation/signing step to occur before PyPI publishing (previously occurred after)

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/publish-to-testpypi.yaml	Added attestations permission and replaced sigstore signing with build provenance attestation before TestPyPI publishing
.github/workflows/publish-to-pypi.yaml	Added attestations permission and replaced sigstore signing with build provenance attestation before PyPI publishing

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.