chore(release): align release pipeline with synth reference (SBOM + SLSA + build-env)

[avrabe]

Summary

Adopts the standardized pulseengine release pattern (per the per-repo Claude agent brief) so rivet's release-asset shape matches synth / spar / sigil / witness. Rivet already had cosign-keyless SHA256SUMS signing; this PR closes the remaining gaps:

• CycloneDX SBOM generated BEFORE SHA256SUMS.txt so its digest enters the manifest (cosign signature transitively covers it).
• SLSA v1 build provenance via actions/attest-build-provenance@v2 over every release-assets/*.tar.gz.
• build-env.txt capturing rustc / cargo / cosign / runner versions (prerequisite for REQ-094 `rivet release-verify`).
• attestations: write permission added alongside the existing contents: write + id-token: write.
• Asset staging dir renamed release/ → release-assets/ to match the cross-repo shared name, so the verification one-liners are copy-pasteable across repos.

Final release-asset shape

```
rivet-vX.Y.Z-.{tar.gz|zip}
rivet-X.Y.Z.cdx.json
SHA256SUMS.txt
SHA256SUMS.txt.sig
SHA256SUMS.txt.pem
SHA256SUMS.txt.cosign.bundle
build-env.txt
(plus VSIX + compliance bundle from existing jobs)
```

Verification one-liners (for release notes)

```bash
cosign verify-blob \
--certificate-identity-regexp \
'https://github.com/pulseengine/rivet/.github/workflows/release.yml@.*' \
--certificate-oidc-issuer \
'https://token.actions.githubusercontent.com' \
--bundle SHA256SUMS.txt.cosign.bundle SHA256SUMS.txt

gh attestation verify rivet-vX.Y.Z-.tar.gz \
--repo pulseengine/rivet
```

Test plan

• YAML parses (`python3 -c "import yaml; yaml.safe_load(...)"`)
• CI run on this PR (mostly a no-op; the release.yml only fires on `v*` tags)
• Next `v0.13.1` tag exercises the full chain end-to-end

What this does NOT do

• Does not implement REQ-094 (`rivet release-verify`) — that REQ takes the same verification one-liners and bakes them into a single subcommand. This PR ships the producer-side primitives that REQ-094 will then consume.
• Does not change the existing compliance-bundle or VSIX jobs; their outputs flow through the same `release-assets/` dir untouched.

Refs: REQ-068, REQ-094

🤖 Generated with Claude Code

[ghost]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Rivet Criterion Benchmarks'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.20.

Benchmark suite	Current: d27c128	Previous: cfe0cdf	Ratio
store_insert/10000	20051567 ns/iter (± 2915939)	13754166 ns/iter (± 376068)	1.46
validate/10000	15358313 ns/iter (± 2400397)	12574742 ns/iter (± 634955)	1.22

This comment was automatically generated by workflow using github-action-benchmark.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!