Add GitHub artifact attestations for release binaries #1364

Request

Please add GitHub artifact attestations to the release workflow so downstream consumers can cryptographically verify binary provenance.

Why

NemoClaw downloads OpenShell binaries in its install scripts. Today we hardcode SHA-256 checksums to verify integrity, but this creates a maintenance burden — every new OpenShell release requires a manual hash update on our side.

The openshell-checksums-sha256.txt release asset helps, but downloading checksums from the same source as the binary doesn't add real security: if a release is compromised, both files can be tampered with.

With artifact attestations, downstream projects can verify binaries with a single command:

gh attestation verify openshell-aarch64-apple-darwin.tar.gz --repo NVIDIA/OpenShell

No hardcoded hashes, cryptographically signed provenance, zero maintenance for consumers.

Context

• NemoClaw PR adding checksum verification: fix(security): add checksum verification for external binary downloads NemoClaw#177
• GitHub docs on artifact attestations: https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds