Harden release artifact trust

[Widthdom]

Summary

• Add GitHub build provenance attestations for release archives, SBOMs, checksum manifests, and checksum signatures.
• Sign sha256sums.txt with a detached GPG signature and publish sha256sums.txt.asc.
• Add CODEOWNERS coverage and contributor docs for release-critical paths.

Validation

• dotnet run --project tools/CodeIndex.Changelog -- check
• ruby -e "require 'yaml'; YAML.load_file('.github/workflows/release.yml'); puts 'release.yml YAML OK'"
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• adversarial review: No blocking/actionable issues found.

Documentation and changelog

• Updated USER_GUIDE.md with release artifact verification guidance.
• Updated CONTRIBUTING.md with release-critical path guidance.
• Added changelog.d/unreleased/1674.security.md.
• Added changelog.d/unreleased/1847.security.md.
• Added changelog.d/unreleased/1677.security.md.

Follow-up candidates

• Configure RELEASE_GPG_PRIVATE_KEY and optional RELEASE_GPG_PASSPHRASE / RELEASE_GPG_KEY_ID secrets in the release-production environment before the next release.
• Enable branch protection requiring CODEOWNERS review for main.

Fixes #1674
Fixes #1847
Fixes #1677