fix: improve OpenSSF Scorecard score

[liudger]

• Use npm ci instead of npm install in linting workflow (Pinned-Dependencies)
• Add SLSA build provenance attestation to release workflow (Signed-Releases)
• Add attestations:write permission for provenance generation

[Copilot]

Pull request overview

This PR improves the repository’s OpenSSF Scorecard results by tightening dependency installation practices and adding SLSA build provenance attestations to the release process.

Changes:

• Switch the Prettier workflow from npm install to npm ci to ensure deterministic installs (Pinned-Dependencies).
• Add GitHub build provenance attestation generation to the release workflow (Signed-Releases).
• Grant the release job attestations: write permission to allow provenance publication.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/release.yaml	Adds provenance attestation step and the required attestations: write job permission.
.github/workflows/linting.yaml	Uses npm ci for reproducible Node dependency installation during Prettier runs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.89%. Comparing base (881f3a5) to head (1877bd1).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1446   +/-   ##
=======================================
  Coverage   99.89%   99.89%           
=======================================
  Files           6        6           
  Lines         955      955           
  Branches      128      128           
=======================================
  Hits          954      954           
  Partials        1        1           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.