feat(ci): upload distribution files to GitHub releases

Add upload-release-assets job that attaches wheel, sdist, and SBOM
to GitHub releases when published. Also fixes verify step to use
verify-pypi instead of verify-testpypi.

Author: tbhb

.github/workflows/release.yml

@@ -193,5 +193,31 @@ jobs:
       - name: Publish to PyPI
         run: just publish-pypi
 
-      - name: Verify PyPi release
-        run: just verify-testpypi ${{ needs.build.outputs.version }}
+      - name: Verify PyPI release
+        run: just verify-pypi ${{ needs.build.outputs.version }}
+
+  # Attach distribution files to the GitHub Release
+  upload-release-assets:
+    name: Upload release assets
+    needs:
+      - build
+      - test
+    if: github.event_name == 'release' && github.event.action == 'published'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    permissions:
+      contents: write # Required to upload release assets
+
+    steps:
+      - name: Download distributions
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        with:
+          name: dist
+          path: dist/
+
+      - name: Upload assets to release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release upload "${{ github.event.release.tag_name }}" dist/* --repo "${{ github.repository }}"