A provenance upload step succeeds on Linux and fails on Windows self-hosted...

The archive is created correctly, yet Windows-specific metadata leaks into the attestation input and changes the final hash.