chore(catalog): re-pin attested-delivery to v0.1.2

[attested-delivery-ci]

Automated, verify-first re-pin of an external plugin to its latest attested release.

Bump

• Plugin: attested-delivery — source repo attested-delivery/.github
• ref: v0.1.1 → v0.1.2
• sha: 36cdbd7d7586 → 508aa7a385d3f6776feb175e40b3a0e9f08402c4
• Release: https://github.com/attested-delivery/.github/releases/tag/v0.1.2 (published 2026-06-23T03:55:41Z)

Verified subject

• Artifact: attested-delivery-0.1.2.tar.gz
• Digest: sha256:6ca2dbce8d25496151e7f1d9f620b3328472899c3b3e57dd3242a36f40d67360

Attestations

Predicate	Signer	Source repo	Verdict
https://slsa.dev/provenance/v1	repo:attested-delivery/.github	attested-delivery/.github	✅ verified

Only a release whose every required predicate verifies reaches this PR, so the
table above is all-green by construction.

Raw gh attestation verify evidence

https://slsa.dev/provenance/v1

predicate: https://slsa.dev/provenance/v1
signer:    https://github.com/attested-delivery/.github/.github/workflows/attest-release.yml@refs/tags/v0.1.2
issuer:    https://token.actions.githubusercontent.com

Re-verify it yourself

gh attestation verify attested-delivery-0.1.2.tar.gz --repo attested-delivery/.github --predicate-type https://slsa.dev/provenance/v1 --format json

catalog-admission re-runs this verification fail-closed on this PR; the PR
auto-merges once admission + the required gates are green.