fix(release): correct BCR publish attestation flow (adopt release_ruleset)

[avrabe]

The BCR publish has never landed. The v1.1.0 release surfaced why: the publish_to_bcr job failed with a 404 fetching the source archive's provenance attestation.

Root cause

publish-to-bcr (attest: true) constructs the attestation URL as <source.template.json .url>.intoto.jsonl and downloads it. It 404'd because:

1. .bcr/source.template.json pointed at the GitHub auto archive (/archive/refs/tags/{TAG}.tar.gz), but the attestation was produced for a bespoke archive and stored in GitHub's attestation API — never uploaded as <that-url>.intoto.jsonl.
2. release.yml pinned publish-to-bcr@v6, which isn't a real release tag (latest is v1.4.x).

Fix — adopt the canonical bazel-contrib flow (per rules-template)

• .github/workflows/release_prep.sh (new): builds rules_wasm_component-<tag>.tar.gz with internal prefix rules_wasm_component-<version>/.
• release.yml rewritten: release_ruleset.yaml@v7.7.7 (draft: true; attests release_files, uploads <archive>.tar.gz.intoto.jsonl) → publish-to-bcr@v1.4.1 (same run, finds the attestation) → finalize (un-drafts).
• .bcr/source.template.json url → the attested release asset: releases/download/{TAG}/rules_wasm_component-{TAG}.tar.gz.
• publish-to-bcr.yml pin v1.4.0 → v1.4.1 for consistency.

Verification

✅ Local: release_prep.sh v1.1.0 emits rules_wasm_component-v1.1.0.tar.gz with prefix rules_wasm_component-1.1.0/ — exactly basename(template.url) + strip_prefix, so the attestation will be where publish-to-bcr looks. JSON/YAML valid.
⏳ Full validation requires an actual release cut (workflow orchestration can't be run locally). Suggested: merge, then cut v1.1.1 through the corrected flow to land the first BCR entry. v1.1.0 itself is already published on GitHub (non-draft) so it won't retro-publish via the draft flow.

Notes

• release_prep.sh is a deliberate exception to the repo no-shell policy — release_ruleset hard-codes this path; it's release CI tooling, not build logic.
• The behavior changes: release notes now come from release_prep.sh (bzlmod snippet) rather than git-cliff, and the archive is built via git archive (reproducible) rather than rsync.

🤖 Generated with Claude Code