Attestation verification failed for cachekit-core-v0.4.0

[github-actions]

The weekly attestation health check failed for cachekit-core-v0.4.0.

Run: https://github.com/cachekit-io/cachekit-core/actions/runs/30359037048

Check that release.yml produced valid SLSA provenance and CycloneDX SBOM
attestations for the published .crate, and that the crate actually
reached crates.io for this tag.

[27Bslash6]

Closing: this issue was filed by a deliberate negative control while fixing LAB-984, not by a real attestation failure.

Run 30359037048 was the first live dispatch of the repaired attestation-check.yml. It went red on the crates.io download (HTTP 403 — the API rejects a generic user agent) and this step fired. That was genuinely useful: the Open issue on failure path had never executed once in the workflow's life, because the job had never been capable of failing.

Attestations for cachekit-core-v0.4.0 are intact and verified — run 30359168255 confirms SLSA provenance and CycloneDX SBOM over digest 6aba1513135a7b92a124ad6983f7e80e5f5c78c4f9c74384079efa3fbf491eab, signed by release.yml.

Fix: #63.