release: musl targets, .vsix artifact + gated marketplace publish, loud Homebrew tap step, keyless artifact signing

[MaximeGaudin]

Summary

Cluster of release-pipeline fixes from the pre-release audit:

• release: no linux-musl (static) target is built #222 — add x86_64-unknown-linux-musl and aarch64-unknown-linux-musl to the release build matrix (with a musl-tools install step), producing slint-linux-amd64-musl.tar.gz / slint-linux-arm64-musl.tar.gz + .sha256, matching the naming convention from fix: publish a sha256 checksum file for every release asset #336. README install section updated with a musl example.
• release: no VS Code Marketplace publish step; .vsix is never a release artifact #200 — the vscode release job now also runs pnpm --filter slint-vscode package and attaches the resulting .vsix to the GitHub release; Marketplace publish already existed behind VSCE_PAT and stays secret-gated (skips cleanly with a warning when absent).
• release.yml's Homebrew tap update has never actually run: the tap repo has no slint formula despite two releases #233 — the Homebrew tap step could only ever silently no-op: it warned and exited 0 when HOMEBREW_TAP_DEPLOY_KEY was missing, which is why the tap repo has no slint.rb after two releases. It now fails the release run with an actionable error when the secret is missing, pre-checks SSH reachability of MaximeGaudin/homebrew-tap, and re-clones after push to verify Formula/slint.rb advertises the released version. The tap repo exists and Formula/slint.rb is the correct path (it currently hosts only void.rb; a tap may host multiple formulas) — the actual blocker is the unconfigured secret, which CI will now surface loudly instead of hiding.
• release: no SLSA provenance, Sigstore/cosign signing, or build attestation for release artifacts #199 — keyless Sigstore signing in each build job via sigstore/cosign-installer (pinned to the full SHA of v4.1.0): every artifact gets .sig, .cert, and .sigstore bundle uploaded next to the tarball. Verify with cosign verify-blob --certificate ... --certificate-identity-regexp '^https://github.com/MaximeGaudin/slint/' --certificate-oidc-issuer https://token.actions.githubusercontent.com --signature artifact.sig artifact. This fits release.yml's build-per-artifact structure without restructuring; full SLSA generic provenance would require a rebuildable workflow and is noted as a follow-up.

Verification notes:

• Release install instructions (curl | sudo tar) have no checksum or signature verification step #132's checksum concern is fully covered by fix: publish a sha256 checksum file for every release asset #336/fix: verify release tarball checksum before sudo install in README #349 (merged) — no residue found; nothing re-done here.
• release: no crates.io publish step exists in release.yml #202 (crates.io publish) is intentionally untouched, pending the crate-name decision.

Fixes

• Fixes release: no linux-musl (static) target is built #222
• Fixes release: no VS Code Marketplace publish step; .vsix is never a release artifact #200
• Fixes release.yml's Homebrew tap update has never actually run: the tap repo has no slint formula despite two releases #233
• Fixes release: no SLSA provenance, Sigstore/cosign signing, or build attestation for release artifacts #199

Secrets required by new/changed steps

• HOMEBREW_TAP_DEPLOY_KEY (existing; now required — the release run fails without it, by design of release.yml's Homebrew tap update has never actually run: the tap repo has no slint formula despite two releases #233)
• VSCE_PAT (existing; optional — Marketplace publish skips when absent)
• OVSX_PAT (existing; optional — Open VSX publish skips when absent; not enabled by this PR)
• No new secrets introduced; GITHUB_TOKEN gains contents: write on the vscode job (release asset upload) and id-token: write on the build job (keyless signing), per least privilege.

Test plan

• actionlint clean on all workflows
• YAML parse check
• CI green on this PR (workflow changes are lint-only in CI, as expected)