Add GitHub artifact attest to APK build/release workflows

[Copilot]

This ports the provenance-hardening from MetaCubeX#769 into Tabby’s workflows so release APKs include verifiable GitHub artifact attestations. The change focuses on enabling OIDC-backed attestation generation in existing APK-producing jobs.

• Workflow permissions

  • Added id-token: write and attestations: write to APK-producing jobs in:
    • .github/workflows/build.yml (build)
    • .github/workflows/release.yml (release)
  • Kept existing contents: write permission unchanged.

• Provenance generation

  • Added actions/attest-build-provenance@v2 immediately after APK build steps in both workflows.
  • Configured attestation scope to generated release APKs:
    • app/build/outputs/apk/release/*.apk

• Resulting behavior

  • Release artifacts produced by CI now emit signed provenance metadata tied to workflow/run context, improving downstream artifact verification.

permissions:
  id-token: write
  attestations: write
  contents: write

- name: Generate Artifact Attestation
  uses: actions/attest-build-provenance@v2
  with:
    subject-path: app/build/outputs/apk/release/*.apk

[Goooler]

https://github.com/actions/attest-build-provenance/releases/tag/v4.0.0