[dunglas]

Four commits:

1. SLSA Build L3: static.yaml, docker.yaml and windows.yaml become reusable workflows. The triggers and concurrency move to new build-static.yaml, build-docker.yaml and build-windows.yaml callers, which release.yaml now dispatches. Verifiers can pin the signer:

   gh attestation verify frankenphp-linux-x86_64 --repo php/frankenphp \
       --signer-workflow php/frankenphp/.github/workflows/static.yaml \
       --source-ref refs/tags/v1.13.3

2. Dedicated signing jobs: build jobs no longer get id-token: write. They upload the binaries as workflow artifacts, and an attest job (no build code) signs them. Docker provenance was already signed in the push job.

3. SBOM attestations: anchore/sbom-action generates an SPDX JSON SBOM in the signing jobs, attested with actions/attest (sbom-path):

   • every static musl/glibc and macOS binary, and the Windows zip (release builds only, same gating as provenance);
   • every per-platform Docker image digest, pushed to Docker Hub. Provenance stays on the multi-platform index.

4. CODEOWNERS: .github/workflows/ and .github/actions/ are owned by @php/frankenphp-admin.

Syft sees Go modules and the PHP version, but not the C libraries linked by static-php-cli. An SBOM from static-php-cli itself would cover them; it's tracked upstream in crazywhalecc/static-php-cli#1118.

Check names of the build workflows now carry the build / prefix.