Add minimal GitHub build attestation workflow

[joy7758]

Summary

• add a standalone Build + Attest GitHub Actions workflow for Python distribution artifacts
• build dist/*, upload them as the python-dist workflow artifact, and generate GitHub artifact attestations via actions/attest@v4
• add a short docs note describing scope, verification path, and plan limitations
• add one minimal README link so the path is discoverable

Boundary

This adds a minimal upstream build provenance path only.
It does not change AEP schema, bundle/receipt/summary semantics, CLI, or runtime evidence behavior.