fix(release): bind attestations to the workflow trigger ref

[rldyourmnd]

Summary

• The automatic release pipeline creates the tag inside the same run that builds the artifact, so GitHub provenance binds the push trigger ref (refs/heads/main), not refs/tags/gds-v*. Offline verification rejected gds-v0.9.8 for exactly that mismatch.
• The envelope now records both refs: source_ref stays the exact release boundary; trigger_ref carries the ref the signer actually records. The expected attestation identity digest and every verifier (bundle, release directory, consumer install) use trigger_ref when present and fall back to source_ref for legacy envelopes.
• The workflow passes --trigger-ref "$GITHUB_REF"; failure envelopes record both refs as well.
• Drops the leftover --extract-harness-evidence-* flags and their archive reader — evidence stopped being a release-builder input when channels were removed.
• Schema: optional trigger_ref (sourceRef shape) on release and release-failure envelopes.

Verification

• scripts/validate_shell.sh PASS (shellcheck 0.11.0, 8 scripts)
• scripts/validate_go_core.sh --quick PASS (tidy, vet, tests)
• go test ./... PASS (all packages)
• python3 -m pytest 70/70 (pinned env)
• scripts/validate_release.sh PASS including integrated assurance on the committed tree
• Backward compatibility: envelopes without trigger_ref verify via source_ref unchanged; allowed_channels remains in the trust policy for legacy artifacts.

Generated with Devin