build: provenance attempt

[nicklasl]

Summary

Implements binary provenance for WASM binaries distributed with OpenFeature providers. When any
provider is released, the WASM binary is automatically built, cryptographically attested, and
uploaded to all relevant GitHub releases with a SHA-256 checksum.

How It Works

Release flow: When Release Please creates a provider release (Java, JS, or Go), a new
publish-wasm-binary job:

1. Builds the WASM binary using our deterministic Docker process
2. Generates a SHA-256 checksum
3. Creates a cryptographic attestation via GitHub's attestation framework
4. Uploads both files to all provider releases that were created

Verification: The idea is that consumers can verify the binary authenticity with:

gh attestation verify confidence_resolver.wasm --owner spotify --repo confidence-resolver

This proves the binary was built from the claimed source code in GitHub Actions and hasn't been
tampered with.

Changes

• Add WASM binary publishing and attestation workflow to release-please.yml
• Capture provider tag names and upload artifacts to all released providers
• Add supply chain security section to README

Related

• Documentation branch