src2sink 1.0.3

No functional changes. Hardens how releases are built and attested.

Added

• SLSA Build L3. Provenance is now generated and signed inside
  slsa-github-generator's reusable workflow, whose steps this repository cannot
  modify and whose signing identity the build steps never see. That isolation is
  what separates L3 from L2: at L2 the identity that signs lives in the same job
  that runs the build, so a compromised build step could produce a tampered
  artefact with authentic-looking provenance. The provenance is attached to the
  GitHub release as multiple.intoto.jsonl and verified with:

  slsa-verifier verify-artifact src2sink-1.0.3-py3-none-any.whl \
    --provenance-path multiple.intoto.jsonl \
    --source-uri github.com/mimecast/src2sink \
    --source-tag v1.0.3

  The L2 attestations from 1.0.2 continue alongside it, so gh attestation verify and the PyPI PEP 740 route both still work — three ways to check the
  same artefact, aimed at different tools.

• Publishing now runs only after provenance generation succeeds, so a provenance
  failure stops a release before the irreversible upload rather than after it.

• A workflow_dispatch trigger on the release workflow that builds and generates
  provenance without publishing, for exercising changes to the release path
  without spending a version number — and a monthly schedule that runs the same
  rehearsal unattended, so breakage in the upstream generator surfaces before a
  release depends on it.

Fixed

• Build provenance no longer attests dist/.gitignore. subject-path: dist/*
  matched the file uv writes there, so 1.0.2's provenance lists it as a third
  subject alongside the wheel and sdist. Cosmetic — the real artefacts were
  attested correctly either way — but a provenance statement claiming a
  .gitignore was a build output undermines confidence in the rest of it. The
  attested subjects are now the two distributions and nothing else:

  $ gh attestation verify src2sink-1.0.3-py3-none-any.whl --repo mimecast/src2sink
  # subjects: src2sink-1.0.3-py3-none-any.whl, src2sink-1.0.3.tar.gz