ci: bump actions/attest-build-provenance from 4.1.1 to 4.2.2

[dependabot]

Summary

Update build provenance attestation from 4.1.1 to 4.2.2 in the container release workflow.

Changes

• Pin actions/attest-build-provenance to the immutable v4.2.2 commit, 4d101475d8b20a2381f78447822ac1eab6504dd8.
• Reviewed the wrapper release, exact source comparisons, and underlying actions/attest 4.2.0 and 4.2.1 releases.
• The wrapper interface and Node 24 action runtime remain compatible. The workflow supplies a single explicit SHA-256 subject and a bare registry image name, satisfying the updated registry validation and bypassing automatic subject discovery.
• No compatibility workaround or duplicated implementation needs removal.

Testing

• git diff --check passed.
• Compared action inputs, forwarding, runtime, subject parsing, registry push behavior, and existing workflow permissions against the exact shipped sources.
• Reviewed initial CI: 40 checks passed, including container validation for both architectures. Windows Node 22 package verification timed out after 180 seconds and caused its two aggregate checks to fail. This job does not execute the upgraded release-only action.
• Updating this description triggers a fresh CI run; merge requires the latest required checks to pass. No application tests were added for the version-pin change.

Risk and rollout

The existing explicit image digest and gated release flow are preserved. Provenance signing and registry publication are release-only operations and were not triggered during this review. The new version takes effect on the next authorized container release; reverting the pin restores 4.1.1.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

Reviewed head 02a669257e827f872085799d9e9f21749b0167d7, including the exact wrapper and underlying action releases/source. The existing explicit SHA-256 image subject, registry push inputs, Node 24 runtime and permissions remain compatible. No code simplification or compatibility fix is needed.

The fresh CI run succeeded: 41 jobs passed and two conditional jobs were skipped. The initial Windows npm-install timeout did not recur. All required current-head checks pass, and no unresolved review threads remain. The merge against latest main is clean and retains the already-merged Buildx upgrade. Public disclosure review is complete.