GA: source tarball + SHA256 + BLAKE3 + provenance attestation pipeline

[justinjoy]

Why (block)

#687 (v1.0.0 GA Epic) lists "Signed source tarball + checksums
(SHA256 + BLAKE3)" and "SBOM + ABI manifest published with the
release" as exit conditions, but the actual tarball-generation
and checksum-emission pipeline is unfiled.

Without a documented pipeline, tarball contents drift between
releases, checksums are computed by hand, and provenance
(SLSA-style attestation) is missing.

Scope

• Tarball generation:
  • meson dist (or a scripts/release/make-tarball.sh)
    produces a deterministic wirelog-<version>.tar.gz.
  • Excludes .git, .omc, build*, subprojects/<dep>
    (pinned via subprojects/*.wrap instead).
• Checksums:
  • SHA256 (industry standard).
  • BLAKE3 (faster, modern; b3sum tool).
  • Both checksums committed alongside the release as
    wirelog-<version>.tar.gz.sha256 and .blake3.
• Provenance attestation (SLSA build provenance):
  • .intoto.jsonl attestation generated by GitHub Actions.
  • Attestation signed via cosign-keyless (GA: GPG + sigstore cosign-keyless signing pipeline + key-management runbook #750).
• Verification recipe:
  • Downstream-friendly verify-release.sh script that:
    1. Verifies the GPG signature on the tag.
    2. Verifies the cosign signature on the tarball.
    3. Verifies SHA256 + BLAKE3.
    4. Verifies the attestation matches the build.

Acceptance

• Tarball builds deterministically (two builds produce
  byte-identical artifacts).
• All four artifacts (tarball, SHA256, BLAKE3, attestation)
  are emitted by the at-tag CI workflow (B19: at-tag CI re-verification of full matrix (Tier-1 + abi + sanitizer + perf) #749 B19).
• verify-release.sh exists in the repo and works on a test
  release.
• docs/RELEASE_PROCESS.md documents the procedure.

Cross-ref: #687, #750 (signing pipeline), #744 (SBOM),
B19 (#749).