Enable Sigstore wheel attestations via pypa/gh-action-pypi-publish

[zeevdr]

Description

pypa/gh-action-pypi-publish already used for OIDC trusted publishing. Adding attestations: true emits Sigstore-backed wheel attestations visible on PyPI. Same credibility tier as npm provenance already in place on TS SDK.

Acceptance criteria

• Set attestations: true in publish step
• Verify attestations appear on PyPI package page
• Document verification path in README
• Cross-link with decree#16 (org-wide attestation plan)