v2.36.4

• Added pull_request, merge_request as additional command aliases for assert pullrequest and attest pullrequest (alongside existing pr, mr, mergerequest).
• Fixed a bug where packaging multiple evidence paths (e.g. --attachments) would fail with "operation not permitted" when any attachment was owned by a different user (e.g. files written by a Docker container). Ownership is no longer preserved during staging.
• Improved error messages when an evidence attachment path cannot be packaged: the error now names the path the user provided rather than an internal temp directory.

What's Changed

• chore: add cmd aliases by @mbevc1 in #1066
• test(aws): add S3 contract tests by @mbevc1 in #1065
• fix(docs): separate flag types into a column by @mbevc1 in #1068
• chore(deps): bump the github-actions-dependencies group with 2 updates by @dependabot[bot] in #1070
• chore(deps): bump the go-dependencies group with 10 updates by @dependabot[bot] in #1071
• fix(attest): don't preserve file ownership when packaging attachments by @mbevc1 in #1076

Full Changelog: v2.36.3...v2.36.4