ci: exclude attestation sidecars from the PyPI artifact-identity assert (#124)

gh-action-pypi-publish v1.14+ writes <dist>.publish.attestation sidecar
files into packages-dir before uploading. The post-publish assert builds
its expected set from dist/ contents, and PyPI serves attestations via
the integrity API rather than as distribution files, so the sidecars can
never appear in the JSON API's urls[] -- the assert now fails on every
release even when the publish is complete and attested. Observed on the
v0.10.1 run (32177134404): both distributions matched by sha256 and both
files have provenance bundles on the integrity API, but the two sidecar
names failed the set comparison twice (initial run and skip-existing
re-run).

Filter *.publish.attestation from the local set; the distribution
set-equality check (including the planted-extra-wheel direction) is
unchanged.

🤖 Generated with Claude Code
Co-Authored-By: [Claude](mailto:noreply@anthropic.com)

Author: tmatup

.github/workflows/release.yml

@@ -447,7 +447,16 @@ jobs:
               sys.exit(0)
 
           remote = {u["filename"]: (u.get("digests") or {}).get("sha256") for u in payload.get("urls") or []}
-          local = sorted(p for p in pathlib.Path("dist").iterdir() if p.is_file())
+          # gh-action-pypi-publish v1.14+ writes `<dist>.publish.attestation`
+          # sidecars into packages-dir before upload. PyPI serves attestations
+          # via the integrity API, never as distribution files, so the sidecars
+          # must not enter the set-equality comparison below -- with them, this
+          # assert fails on every release even when the publish is complete and
+          # attested (observed on the v0.10.1 run).
+          local = sorted(
+              p for p in pathlib.Path("dist").iterdir()
+              if p.is_file() and not p.name.endswith(".publish.attestation")
+          )
           if not local:
               print("::error::no files in dist/ to compare -- the download-artifact step produced nothing")
               sys.exit(1)