Function collect_release_attestation_evidence 

pub fn collect_release_attestation_evidence(
    client: &GitHubClient,
    owner: &str,
    repo: &str,
    head_tag: &str,
    bundle: &mut EvidenceBundle,
)

Phase 3: Check release asset attestations via the GitHub API and merge into the bundle.

Downloads only .sha256 sidecar files (a few KB), then queries the Attestations REST API for each asset digest. No binary downloads needed.