fix: extract the DSSE envelope for in-toto provenance

[JacobOptimiza]

Problem

The previous implementation compacted the entire Sigstore bundle produced by actions/attest and saved it with a .intoto.jsonl extension. The in-toto JSON Lines standard requires each line to be the DSSE envelope itself (payloadType/payload/signatures); a Sigstore bundle (mediaType/dsseEnvelope/verificationMaterial) at the root is a renamed bundle, not the standard form. SIGNING.md also overstated what gh attestation verify checks against that file.

Fix

• New versioned script scripts/convert-attestation-to-intoto.ps1: extracts bundle.dsseEnvelope, writes it as one compact JSON line, and validates end-to-end before publishing - exactly one JSON object per line; DSSE envelope shape at root; explicitly rejects renamed Sigstore bundles (no dsseEnvelope/verificationMaterial/mediaType at root); decodes payload into an in-toto Statement (_type in-toto v1); requires a SLSA provenance predicateType (v1 or v0.2); verifies every expected architecture artifact appears as a subject with a valid sha256 digest; requires non-empty signatures.
• release.yml now calls the script instead of the inline transformation, passing the three per-architecture artifact names. The original DevNav-build-provenance-<arch>.sigstore.json bundle with all verification material is kept unchanged.
• SIGNING.md now describes precisely what each file is (bundle = envelope + Fulcio cert + Rekor entries; .intoto.jsonl = standard envelope representation) and what each verification mechanism actually verifies (gh attestation verify resolves attestations from the GitHub API by digest, not from the downloaded file).

Validation

Built a fixture faithful to the pinned actions/attest v4.2.2 output (bundle shape confirmed from the action's own source at the pinned commit): positive case produces a 1-line JSONL whose root is the envelope, payload decodes to a SLSA v1 Statement with the three expected subjects; negative cases (renamed bundle, non-SLSA predicate, missing subject, no dsseEnvelope) all fail. Permanent Pester suite IntotoProvenance.Tests.ps1 (4 tests) added; full Pester 125/0 with coverage gates PASS; PSScriptAnalyzer and workflow YAML validated; git diff --check clean.