chore(catalog): re-pin attested-delivery to v0.1.1

[attested-delivery-ci]

Automated, verify-first re-pin of an external plugin to its latest attested release.

Bump

• Plugin: attested-delivery — source repo attested-delivery/.github
• ref: v0.1.0 → v0.1.1
• sha: f211de97395c → 36cdbd7d75865b88e8beec4813c1d3587fa98644
• Release: https://github.com/attested-delivery/.github/releases/tag/v0.1.1 (published 2026-06-23T03:20:28Z)

Verified subject

• Artifact: attested-delivery-0.1.1.tar.gz
• Digest: sha256:37305f61f03e4418727e8d9d1dbd4c62dc060dcbc8777df2e1cc1e85fad93849

Attestations

Predicate	Signer	Source repo	Verdict
https://slsa.dev/provenance/v1	repo:attested-delivery/.github	attested-delivery/.github	✅ verified

Only a release whose every required predicate verifies reaches this PR, so the
table above is all-green by construction.

Raw gh attestation verify evidence

https://slsa.dev/provenance/v1

Re-verify it yourself

gh attestation verify attested-delivery-0.1.1.tar.gz --repo attested-delivery/.github --predicate-type https://slsa.dev/provenance/v1

catalog-admission re-runs this verification fail-closed on this PR; the PR
auto-merges once admission + the required gates are green.