ci: add ProofX execution proof to release workflow

[EslaM-X]

ci: add ProofX execution proof to release workflow

What this does

Adds a ProofX workflow that generates a cryptographic proof for each release. After goreleaser builds the binaries and GitHub publishes the release, this workflow:

1. Collects evidence from the CI run (commit SHA, environment, Go version)
2. Binds the evidence using a SHA-256 Merkle root
3. Signs the binding with Ed25519
4. Uploads proof.json as a release artifact

What this proves

• The release was created from this specific commit
• The CI environment is recorded (Go version, OS)
• Anyone can independently verify: proofx verify --artifact actionlint --proof proof.json

What this does NOT prove

• That the build is reproducible (actionlint already has attest-build-provenance for SLSA)
• That the tests are comprehensive
• Any external claim beyond the evidence collected by the protocol

Why this might be useful

actionlint ships prebuilt binaries that run inside CI pipelines with GITHUB_TOKEN access. The existing attest-build-provenance provides SLSA provenance through GitHub's infrastructure. ProofX adds an independent, portable verification layer — a self-contained proof that doesn't rely on GitHub's attestation servers.

Changes

• .github/workflows/proofx-release.yaml — new workflow file
• No changes to existing workflows

Verification

After release, anyone can verify:

proofx verify --artifact actionlint --proof proof.json

Or visit https://proofx.dev for browser-based WASM verification.

Notes

• This is additive only. No existing workflows are modified.
• Badges are optional. The PR only adds the workflow.
• If this doesn't align with actionlint's goals, happy to close or modify.

Docs: https://github.com/EslaM-X/proofx