fix(signing): skip attestation upload when artifact exists

[leodido]

Problem

Multiple workflows building the same artifact concurrently can overwrite each other's SLSA attestations, causing verification failures. This happens when:

1. Workflow A builds artifact (checksum A), uploads to S3, signs it, uploads attestation A
2. Workflow B builds artifact (checksum B), finds artifact exists (skips upload), signs LOCAL artifact B, uploads attestation B
3. Result: S3 has artifact A + attestation B → verification fails

Part of https://linear.app/ona-team/issue/CLC-2096/prevent-attestation-overwrites-in-concurrent-builds

Solution

Check both artifact and attestation existence before uploading:

1. Both exist: Skip both uploads (prevents overwrites from concurrent builds)
2. Only artifact exists: Upload attestation only (handles old builds before SLSA)
3. Neither exists: Upload both (normal flow)
4. HasFile check fails: Fallback to upload (safe default)

This ensures:

• Concurrent builds don't overwrite each other's attestations
• Old artifacts without attestations get attestations added
• Safe fallback behavior when cache checks fail

Changes

Code Changes

• Modified UploadArtifactWithAttestation to check attestation existence when artifact exists
• Added logic to upload attestation only when artifact exists but attestation is missing
• Updated logging to clearly indicate which scenario is occurring
• Maintained safe fallback behavior when HasFile checks fail

Test Changes

• Updated TestArtifactUploader_SkipsExistingArtifacts to verify both artifact and attestation exist
• Added TestArtifactUploader_UploadsAttestationWhenMissing to test missing attestation scenario
• Updated TestArtifactUploader_SimulatesDownloadedArtifactWorkflow to include attestation in setup
• Updated TestArtifactUploader_PreventsAttestationOverwrite to verify race condition fix
• Added TestArtifactUploader_AttestationCheckError to test fallback when attestation check fails

Testing

All tests pass:

• 19 ArtifactUploader tests pass (added 2 new tests)
• Complete signing package test suite passes (6.1s)
• New tests verify all three scenarios work correctly

[geropl]

LGTM!