This patch moves said check out of the signing loop and performs the
check early in the process. It is then able to report multiple
problems in a single error.

…bundle

💅 Bundle attestation existence check together

They are pinned instead of using `-latest` in the interest of better
reproducibility in the CI.

Previously GitHub updated their `ubuntu-latest` images to use Ubuntu
24.04 which has Python 3.12 as the default interpreter. Before that,
it was Ubuntu 22.04 with Python 3.9. This caused an uncontrolled
runtime bump which led to an incompatibility discovery — older
versions of `setuptools` are incompatible with Python 3.12.

This bumps the `setuptools` version following the previous commit
da900af that pins the distro version.
Going forward, these two must be bumped in tandem to avoid situations
when one gets upgraded suddenly but the other doesn't.

This is achieved by upgrading Twine to v6.1.0. Prior to this version,
Twine was unable to pick up and publish licensing information declared
in the new `License-Expression` core packaging metadata [[1]] [[2]].
And now it does that.

Resolves #325.

[1]: https://packaging.python.org/en/latest/specifications/core-metadata/#license-expression
[2]: https://peps.python.org/pep-0639/#spdx

Ref: pypa/twine#1180

…-02-2025