Implement attested CI publishing for registry plugins

[khoinguyenpham04]

This Roadmap discussion mirrors #1687: Implement attested CI publishing for registry plugins.

Use this discussion to upvote the roadmap item and discuss priority, use cases, and product feedback. Keep implementation tracking, reproduction details, and PR-specific feedback on the source issue.

• Source issue: #1687
• Status: Open
• Labels: None
• Original author: ascorbic

Original Issue

Goal

Plugin authors should be able to publish releases from CI with verifiable provenance, as described in the registry RFC.

Scope

Add the CLI, registry record, and aggregator support needed to publish from CI without treating a long-lived publisher secret as the trust model.

Acceptance criteria

• CI publishing binds a release to publisher identity and workflow provenance.
• Published records expose enough metadata for the aggregator/admin to display or audit provenance.
• Artifact checksum and capability manifest validation still apply.
• Documentation explains setup and the trust model.
• Tests cover accepted and rejected attested publishing flows.