ci: disable sigstore attestations to fix 502 from rekor

Sigstore's rekor server returning intermittent 502 Bad Gateway,
blocking all publishes. Attestations are optional; disable until
the service stabilizes.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.github/workflows/publish.yml

@@ -25,3 +25,5 @@ jobs:
       - run: python -m build
 
       - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: false