fix: attach SLSA provenance bundle to release

[robfrank]

Summary

The catalog re-review of v1.0.0-beta.2 cleared the package.json/plugin.json mismatch but still emits:

💡 no-provenance-attestation - Cannot verify plugin build.

Our actions/attest-build-provenance step is producing a valid SLSA v1 bundle (verifiable locally with gh attestation verify), but the validator runs in an environment that can't reach the GitHub attestations API or Sigstore to discover it. Attaching the in-toto bundle as a release asset lets the validator verify the zip's provenance from a local file.

Changes

• Capture the bundle path output from attest-build-provenance and rename it to <zip>.intoto.jsonl next to the zip.
• Add the .intoto.jsonl to both the GitHub release files: and the workflow artifact path:.
• Bump package.json to 1.0.0-beta.3.
• CHANGELOG entry.

Note

This is a 💡 recommendation, not a ❌ blocker, in the validator output. The previous release was technically eligible for review with this hint outstanding. Fixing it now to keep the listing clean.

After merge

git checkout main && git pull
git tag v1.0.0-beta.3
git push origin v1.0.0-beta.3

Then update grafana.com ticket #228429 with the new zip/sha1 URLs.

Test plan

• YAML parses
• package.json parses
• Tag v1.0.0-beta.3 produces a release with .zip, .sha1, and .intoto.jsonl assets
• Validator no longer flags no-provenance-attestation (or flags it less strongly)

[gemini-code-assist]

Code Review

This pull request updates the version to 1.0.0-beta.3 and adds a corresponding entry to the changelog regarding SLSA provenance. Feedback indicates that the functional changes to the build workflow mentioned in the description are missing from the current diff and should be included.

[gemini-code-assist]

The pull request description mentions functional changes to the build workflow, such as capturing the SLSA provenance bundle and adding it to the release assets. However, these changes are not present in the current diff, which only includes the version bump and changelog update. Please include the relevant workflow files (e.g., .github/workflows/release.yml) to complete the implementation.