Graphite Community

The release binaries on `withgraphite/homebrew-tap` (`gt-linux`, `gt-macos-arm64`, etc.) don't currently have any cryptographic provenance attached. Would it be possible to enable <https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds|GitHub Artifact Attestations> on them? This would let users verify that a binary was built from the expected commit by the official release workflow.

It's also picked up automatically by tool managers -- for example, <https://mise.jdx.dev/|mise> verifies attestations at install time when they're available (<https://github.com/jdx/mise/blob/main/SECURITY.md|security docs>).

Thanks for the flag! I raised with the team, and we're not able to prioritize this right this second. But it's on our radar!
