fix(ci): attest release artifacts directly

.github/workflows/release.yml

@@ -9,6 +9,7 @@ permissions:
   contents: write
   id-token: write
   attestations: write
+  artifact-metadata: write
 
 concurrency:
   group: release-${{ github.ref }}
@@ -56,7 +57,10 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Attest Release Checksums
+      - name: Attest Release Artifacts
         uses: actions/attest@v4
         with:
-          subject-checksums: src/dist/epusdt_${{ github.ref_name }}_checksums.txt
+          subject-path: |
+            src/dist/*.tar.gz
+            src/dist/*.zip
+            src/dist/*_checksums.txt