A GitHub release workflow signs artifacts and still fails attestations

A release pipeline succeeds through signing and fails only at provenance verification after matrix builds were parallelized.