attestload v0.3.0

Attest-before-load gate for coding agents: sign Skills and MCP servers into verifiable SBOM + provenance, and refuse to load unattested code.