Update actions/attest pin and attestation job digests to v4.2.2

[Copilot]

Summary

The Dependabot bump of actions/attest to 1e69f48acb82d1966a394da916b4c1698aa569d6 (#88) broke release-readiness validation because the validator still pinned the old v4.2.1 SHA and the exact SHA256 digests of the three OIDC attestation jobs.

Updated the pin and recomputed the affected job digests:

• scripts/release-readiness.mjs
  • ATTEST_ACTION → actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6
  • PUBLICATION_CANDIDATE_ATTESTATION_JOB_SHA256
  • APPROVAL_WITNESS_ATTESTATION_JOB_SHA256
  • APPROVAL_EVIDENCE_ATTESTATION_JOB_SHA256
• tests/release-oidc-isolation.spec.ts
  • matching ATTEST constant

Validation

• Targeted tests cover the changed behavior.
• corepack pnpm@10.34.0 verify passes.
• Public behavior changes include a Changeset.
• Documentation and contract fixtures are updated where needed.
• No credentials, private endpoints, or sensitive error causes are included.

Release impact

None.