feat: expand CLI authentication workflows and vault safeguards

.github/workflows/build.yml

@@ -98,3 +98,19 @@ jobs:
             target/debug/cotp*
             target/aarch64-unknown-linux-gnu/debug/cotp*
           if-no-files-found: error
+
+  headless:
+    name: Headless build without desktop clipboard dependencies
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: headless
+      - run: cargo clippy --locked --no-default-features -- -D warnings
+      - run: cargo test --locked --no-default-features

.github/workflows/deploy.yml

@@ -88,6 +88,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
+      attestations: write
     steps:
       - name: Checkout sources
         uses: actions/checkout@v7
@@ -128,6 +130,15 @@ jobs:
               fi
           done
 
+      - name: Create release checksums
+        working-directory: dist
+        run: sha256sum *.tar.xz *.zip > SHA256SUMS
+
+      - name: Attest release artifacts
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: dist/*
+
       - name: Upload binaries to release
         uses: svenstaro/upload-release-action@v2
         with: