Add release provenance verification

[Scriptception]

Summary

Implements issue #76's release-provenance and installation-verification machinery.

• builds provenance-stamped wheel and sdist artifacts once, then verifies each handoff
• generates SPDX SBOMs, SHA256SUMS, and GitHub attestations for release artifacts
• adds a strict cross-distribution identity verifier for wheel, sdist, and Claude plugin
• documents checksum, SBOM, provenance, and attestation verification
• hardens the verifier against undeclared plugin content, self-asserted rendered output, archive expansion, and symlink inputs

Why

Skilldeck's first trusted release needs users and operators to be able to independently verify the released package, generated Claude plugin, and SBOM without treating a download as implicitly trusted.

Validation

• .venv/bin/pytest -q — 156 passed
• .venv/bin/ruff check scripts src tests
• .venv/bin/ruff format --check scripts src tests
• .venv/bin/mypy src
• python3 scripts/build_plugin.py --check
• git diff --check

Release boundary

This PR creates verification machinery only. It does not create a tag, publish to PyPI, or deploy anything. The first real publication and external PyPI/GitHub attestation readback remain the issue #80 release gate.