chore: move away from deprecated attest action

[mbevc1]

Upstream has consolidated attest* actions in a single GHA and others are just a passthrough. We should consolidate those and use supported action: https://github.com/actions/attest

[claude]

Claude finished @mbevc1's task in 1m 48s —— View job

---

PR Review: Move away from deprecated attest action

• Gather context and read changed files
• Run static analysis checks
• Review code changes
• Post review feedback

Summary

Static analysis: go build, go vet, and go mod tidy all pass cleanly — no Go code changes in this PR, as expected.

Overall: Good housekeeping PR. The migration from actions/attest-build-provenance@v4 → actions/attest@v4 is straightforward, and the trailing whitespace cleanup is a nice touch.

One concern to verify: The SBOM attestation steps (both in binary_provenance.yml and docker.yml) previously used actions/attest-sbom@v4 which had a native sbom-path input. The consolidated actions/attest@v4 action may not support sbom-path directly — it may require predicate-path + predicate-type instead. Please verify this against the actions/attest README. I've left inline comments on the specific lines.

If actions/attest@v4 does support sbom-path as a passthrough/alias, then this PR is good to go as-is.

What's good

• Clean 1:1 migration with no logic changes
• Whitespace/trailing space cleanup included
• Fixes missing newline at end of file in binary_provenance.yml