fix(ci): ensure deterministic WASM builds

Disable provenance attestations and set SOURCE_DATE_EPOCH to fix
non-deterministic builds in docker/build-push-action@v6.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: nicklasl

.github/workflows/ci.yml

@@ -35,6 +35,9 @@ jobs:
         with:
           context: .
           push: false
+          provenance: false
+          build-args: |
+            SOURCE_DATE_EPOCH=0
           cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/cache:main
           secrets: |
             "js_e2e_test_env=${{ secrets.JS_E2E_TEST_ENV }}"
@@ -45,6 +48,9 @@ jobs:
         with:
           context: .
           push: false
+          provenance: false
+          build-args: |
+            SOURCE_DATE_EPOCH=0
           cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/cache:main
           cache-to: type=registry,ref=ghcr.io/${{ github.repository }}/cache:main,mode=max
           secrets: |

Dockerfile

@@ -5,6 +5,10 @@
 # ==============================================================================
 FROM alpine:3.22 AS rust-base
 
+# Accept SOURCE_DATE_EPOCH as a build arg for reproducible builds
+ARG SOURCE_DATE_EPOCH=0
+ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
+
 # Install system dependencies
 # - protoc/protobuf-dev: Required for prost-build (proto compilation in build.rs)
 # - musl-dev: Required for linking Rust binaries on Alpine