ci: add build provenance attestation for dist/index.js

[kurok]

Summary

• Adds actions/attest-build-provenance@v2 to the package.yml workflow
• Generates a signed SLSA provenance attestation for dist/index.js after each build
• Attestations are visible at https://github.com/namecheap/ec2-github-runner/attestations
• Required permissions added: id-token: write, attestations: write

How it works

After npm run package builds the dist bundle, the attest step signs it using GitHub's OIDC token and publishes the attestation to the GitHub Sigstore-compatible store. Anyone can verify the artifact with:

gh attestation verify dist/index.js --repo namecheap/ec2-github-runner

Test plan

• Package workflow completes successfully on merge to main
• Attestation appears at https://github.com/namecheap/ec2-github-runner/attestations