* ci: resolve attestation eligibility from repository API
The publish guard in #103 used github.repository_owner_type, which is not
part of the documented github context and evaluates empty on push. That
made the OR condition true and the attest step always ran.
Query repos/{owner}/{repo} for owner.type and private, skip attestation
only for User-owned private repositories, and gate the attest action on
the resolved step output.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* test: escape workflow placeholders for Biome noTemplateCurlyInString
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
5d65b8ef97