ci: fix cert-bot conformance root publish for new files

Stage conformance JSON before comparing to HEAD; git diff --quiet on paths
does not detect untracked files, so the first root commit was skipped.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Nathan Gillett

.github/workflows/conformance-attestation.yml

@@ -133,14 +133,14 @@ jobs:
           set -euo pipefail
           cp intentproof-spec/conformance-certificate.json conformance-certificate.json
           cp intentproof-spec/conformance-report.json conformance-report.json
-          if git diff --quiet -- conformance-certificate.json conformance-report.json; then
+          git add conformance-certificate.json conformance-report.json
+          if git diff --cached --quiet; then
             echo "No conformance artifact updates to commit."
             exit 0
           fi
           git config user.name "intentproof-cert-bot[bot]"
           git config user.email "intentproof-cert-bot[bot]@users.noreply.github.com"
           git config --local --unset-all http.https://github.com/.extraheader || true
           git remote set-url origin "https://x-access-token:${INTENTPROOF_CERT_BOT_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
-          git add conformance-certificate.json conformance-report.json
           git commit -m "chore(ci): update conformance certificate and report"
           git push