Fix release image provenance

[tgrunnagle]

Address #38 (which is now manifesting as WARN MCP server mcp-optimizer:latest has no provenance information set, skipping image verification)

Issue
When you build for multiple platforms (platforms: linux/amd64,linux/arm64) with provenance: true, the attestation gets created but may not be properly associated with the manifest list. This is a known limitation in Docker buildx when dealing with multi-platform builds.

Solution
Use provenance: mode=max - This ensures provenance is properly attached even for multi-platform builds:

[claude]

PR Review

Summary: This PR fixes provenance attestation for multi-platform Docker builds by changing provenance: true to provenance: mode=max.

✅ Strengths

• Correct fix: Using mode=max is the recommended approach for multi-platform builds with Docker buildx
• Minimal change: Single-line change reduces risk
• Well documented: PR description clearly explains the issue and solution

📝 Observations

• The change aligns with Docker buildx best practices for multi-platform manifest lists
• SBOM generation (line 71) remains enabled, which is good for supply chain security
• Cosign signing workflow (lines 73-88) will continue to work correctly with this change

✓ No Issues Found

• No code quality concerns
• No security regressions
• No breaking changes
• Performance impact is negligible (build-time only)
• Change follows repository conventions

Recommendation: ✅ Approve and merge