feat(attestation): opt-in CAS-only attestation storage

Add a controlplane config flag attestations.skip_db_storage that, when
enabled and the workflow run's CAS backend is non-inline, uploads the
attestation bundle to CAS synchronously and records only the digest on
the workflow run, skipping the attestation table row. Inline backends
and the flag-off case keep the existing async upload and DB persistence
behaviour.

Refs #2126

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

app/controlplane/configs/config.devel.yaml

@@ -120,3 +120,6 @@ enable_profiler: true
 #   url: http://localhost:8002/v1/authorize
 
 ui_dashboard_url: http://localhost:3000
+
+attestations:
+  skip_db_storage: true

app/controlplane/configs/samples/config.yaml

@@ -101,4 +101,11 @@ enable_profiler: true
 # This means that the controlplane will send the JWT token to a remote endpoint to verify it
 # federated_authentication:
 #   enabled: true
-#   url: http://localhost:8002/machine-identity/verify-token
+#   url: http://localhost:8002/machine-identity/verify-token
+
+# Attestation storage and processing options
+# attestations:
+#   # When true, skip writing the attestation bundle to the database; the bundle is
+#   # stored exclusively in the configured CAS backend. Has no effect when the
+#   # workflow run's CAS backend is inline.
+#   skip_db_storage: false