fix(release-supply-chain): migrate SBOM attestation to actions/attest

[rldyourmnd]

Summary

Replace the deprecated actions/attest-sbom with actions/attest (native SBOM
mode). The 0.3.0 release run flagged the deprecation. actions/attest accepts
the identical sbom-path input — actions/attest-sbom is now just a wrapper
over it — so the SPDX predicate type and scripts/verify_attestations.sh remain
unchanged. Drops the now-unused attest-sbom tools entry and refreshes stale
risk text.

Type of change

• Hardening / dependency-deprecation fix

Threat-model note

No new surface. Same pinned action family (actions/attest@a1948c3f… v4.1.1,
already tracked in catalog/tools.yml), same job permissions (id-token: write,
attestations: write, contents: write), same SPDX predicate type. The
attestation verification path is byte-for-byte compatible.

Permissions diff

None.

Checklist

• Third-party action pinned to full SHA + version comment.
• Least-privilege permissions unchanged.
• validate_all + actionlint + zizmor green.
• CHANGELOG.md [Unreleased] updated.
• [~] DCO signed-off; the GitHub-signed squash-merge satisfies required_signatures.

Tier impact

• Both tiers (release-supply-chain serves both).

Verification note

The attestation re-proves only on the next release (0.3.0 is immutable). The
change is drop-in per the action's documented input compatibility; static gates
are green and the SBOM predicate / verify path is unchanged.