Add Sigstore workspace attestations

[jezdez]

Summary

• Add Sigstore DSSE/in-toto workspace attestations for manifest and conda.lock provenance.
• Wire signing and verification into conda workspace lock, install, archive, and unarchive, including fail-closed CLI guardrails for verification/signing flags.
• Document the attestation schema and verification contract, add the signing extra, and expand CLI/archive/attestation tests.

Fixes #62.

Validation

• pixi run -e test pytest
• pixi run ruff check
• pixi run typecheck
• pixi run format-check
• pixi run -e docs docs

Notes

• Raw full-tree pixi run ruff format --check still reports unrelated untracked demos/generate-voiceover.py; the project-scoped pixi run format-check passes.