[DrunkOnJava]

Summary

The Python wheels and the sdist on a release page go into SHA256SUMS and the build-provenance attestation, so gh attestation verify <file> -R DrunkOnJava/rvt-rs works for each of them and the one attested SHA256SUMS checks every file on the page but the provenance bundle. docs/install.md and RELEASE.md stop saying coverage is the CLI archives only.

Motivation

#1466: the release page carries seven wheels and the sdist beside the CLI archives, and none of them was in SHA256SUMS or the attestation. The checksum job is the hardest job of a release to test before a real tag, so this adds a way to run it on any ref and was proved that way (below).

Changes

• .github/workflows/release-binaries.yml: checksums hashes every file the run holds for the page (the archives, and for a release or a python rehearsal the wheel-* and sdist artifacts); the attestation moves from upload to a new attest job, which checks the page against SHA256SUMS (every line has its file with that hash, every file a line) before signing dist/*, and hands the signed page to upload as the release-page artifact; upload keeps contents: write, loses the OIDC token and attestations: write, and attaches that artifact only; image downloads the archives and SHA256SUMS instead of every artifact (so the new artifacts cannot race into its directory); a workflow_dispatch input python builds one wheel and the sdist so the same jobs run before a tag. The python job always runs and its steps carry the if: a job-level if skipped image, attest and upload behind it in the first design's pull request run (42134335447), which a release would have done too.
• .github/workflows/publish.yml: release-binaries names build-wheels and build-sdist in needs (already transitive through publish-crate), and its comment says what the page carries.
• tools/ci/check-workflows.py and its failure-first tests: fails when checksums, attest and upload stop describing the same files, and on a job-level if on build, python or checksums.
• docs/install.md, RELEASE.md (including how to rehearse the page before a tag), docs/maintaining.md, changelog.d/changed/1457-release-preflight.md (its "in neither (Release page: add the wheels and the sdist to SHA256SUMS and the build-provenance attestation #1466)" clause), and a new fragment.
• docker/stage.sh and tools/ci/release_preflight.py are unchanged: stage.sh checks with --ignore-missing, and the preflight decides nothing about the page.

Testing

Unit tests are banned in this repository: do not add them. Show the change working end to end on real files instead.

• tools/check-local.sh: not applicable, no src/ change. actionlint and python3 tools/ci/check-workflows.py are clean; zizmor is clean (7 suppressed, 8 before) and at the auditor persona has 7 findings against 8 on main, none new.
• Verified end to end, on head 872f6b6 (the later commit only adds the changelog fragment):
  • Release binaries run 42137536209, a workflow_dispatch with python=true on this branch: every job passed, Attach to the GitHub Release skipped, the image's login, push and attestation steps skipped. The downloaded release-page artifact holds the five archives, one wheel, the sdist, SHA256SUMS and the bundle; sha256sum -c SHA256SUMS passes for the seven files it lists; a real gh attestation verify -R DrunkOnJava/rvt-rs passes on the wheel, the sdist, SHA256SUMS, the Linux x86_64 archive and the Windows archive; the attestation's eight subjects are exactly the seven lines of SHA256SUMS plus SHA256SUMS. docker/stage.sh passes on that directory and on the two Linux archives with SHA256SUMS alone (lines of absent files skipped).
  • Pull request run 42137542924, same head (no wheels): SHA256SUMS lists the five archives, the image job's stage.sh and smoke test pass, attest and upload skipped.
  • Earlier head bba955b, runs 42134282381 (dispatch, same results) and 42134335447 (pull request): the second showed image skipped behind the skipped python job, fixed in 872f6b6.
• Not measured: a tag push (the only run of the upload job, of the seven-wheel set where the rehearsal builds one, and of the image push after its two-step download); workflow_call itself, whose inputs.upload side of the conditions the dispatch cannot set.
• Scratch output: the two dispatches signed real attestations (ref refs/heads/ci/1466-release-page-checksums, trigger workflow_dispatch, runs 42134282381 and 42137536209) for their own wheels, sdist, archives and SHA256SUMS, none of them a release file; the public Sigstore log keeps them. Both runs' artifacts are deleted.

Audit-honesty checklist

• README / docs reflect the current state after this PR
• A user-visible change has its entry as a fragment under changelog.d/<section>/
• No emojis, no private paths

Breaking changes

None.

Related issues

Closes #1466
Refs #1457