Update README release notes

Author: raub

README.md

@@ -14,6 +14,22 @@ This is a part of [Node3D](https://github.com/node-3d) project.
 npm install @node-3d/steam-api
 ```
 
+## Binary Provenance
+
+Release binary archives for this package are published by public GitHub Actions
+workflows.
+When a release asset includes a GitHub Artifact Attestation, you can verify that
+the downloaded archive was published by the visible workflow in this repository:
+
+```console
+gh release download <tag> -R node-3d/steam-api -p <platform>.gz
+gh attestation verify <platform>.gz -R node-3d/steam-api
+```
+
+The attestation links the archive to the repository, workflow, commit, and
+release build identity. It does not replace review of the source code, workflow,
+or third-party library contents.
+
 Published packages include prebuilt native binaries.
 A consumer install doesn't need a compiler or a local Steamworks SDK copy.