Publish prebuilt FlowScope CLI binaries

[dvasdekis]

Summary

• Build and publish flowscope CLI archives for:
  • x86_64-unknown-linux-gnu
  • aarch64-unknown-linux-gnu
  • x86_64-apple-darwin
  • aarch64-apple-darwin
  • x86_64-pc-windows-msvc
• Include the CLI version and target triple in each archive name.
• Publish per-archive .sha256 files and an aggregate SHA256SUMS manifest.
• Generate GitHub build provenance attestations for the release assets.
• Restrict crates.io and npm publishing to the canonical pondpilot/flowscope repository so fork runs are safe.
• Build Linux aarch64 natively to avoid the bundled DuckDB cross-GCC compiler failure observed during testing.

Validation

The corrected fork workflow completed successfully:

https://github.com/dvasdekis/flowscope/actions/runs/32924691441

All five archives and checksum assets were present. The aggregate manifest passed sha256sum -c, and each archive contained the expected flowscope executable. Package publishing was skipped on the fork.

The temporary fork release and tag used for validation were removed after verification.

Fixes #65

[melonamin]

I opened #72 for the prebuilt CLI binary scope of this PR. It starts from current upstream master (v0.9.1) and preserves the four binary release commits with their original authorship. The fork's current master also contains analyzer, export, and fork release changes outside #65, so those are left for separate PRs.

I'm running the five-target release dry run and PR CI on #72 now. Once those pass and #72 merges, I'll close this PR as superseded.

[melonamin]

Superseded by merged #72, which preserves the four binary release commits and closes #65. The other fork changes can be proposed separately.