chore: grant artifact-metadata:write to the GHCR publish job (#2228)

The `publish-github-container-registry` job's attestation step emitted two
warning annotations on every release — the only annotations on an otherwise
green release run:

  Failed to create storage record: Error: Failed to persist storage record:
  no artifacts found
  Please check that the "artifact-metadata:write" permission has been included

The attestation itself was never affected: it signed, uploaded to Rekor, to
the repository and to the registry, and `gh attestation verify` passes against
the published 2.5.0 image. What was not landing is the separate artifact
metadata *storage record* — GitHub's org-level index of where a published
artifact lives.

Both of the issue's open questions are now answered:

1. `artifact-metadata` is a documented `permissions:` key (read/write/none),
   so the workflow parses. Pushing this branch runs CI and validates that.

2. The `no artifacts found` text does NOT mean this job uploaded no *workflow*
   artifact. It is the generic 404 body of the org artifact-metadata REST API
   that `@actions/attest` POSTs to (`createStorageRecord`); the sibling read
   endpoint returns the identical message for 2.5.0's real digest and for an
   all-zeros digest that cannot exist. The documented precondition actually
   unmet is this permission: the action emits a storage record when
   `push-to-registry` is true AND the workflow carries `artifact-metadata:
   write`, and the repo is org-owned as the API requires.

Confirmation that the record lands can only come from a release run, so the
step also carries a comment recording the evidence and the exact post-release
check — and what to do instead (`create-storage-record: false` plus a note) if
the warning survives. Either branch satisfies the issue's acceptance criterion
rather than leaving an unexplained warning in the release channel.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgCNAyMgKX1Fm3uhrAyeP9
Signed-off-by: cliffhall <cliff@futurescale.com>

.github/workflows/main.yml

@@ -283,6 +283,11 @@ jobs:
       contents: read
       packages: write
       attestations: write
+      # Lets `attest-build-provenance` write the artifact metadata storage
+      # record alongside the provenance itself (#2228). See the long comment on
+      # the "Generate artifact attestation" step for why this is separate from
+      # `attestations: write` and what to check after the next release.
+      artifact-metadata: write
       id-token: write
     steps:
       - name: Checkout code
@@ -326,6 +331,38 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
       - name: Generate artifact attestation
+        # Two scopes, two different things, and only the first is the
+        # attestation (#2228). `attestations: write` persists the signed SLSA
+        # provenance — that half has always worked, and
+        # `gh attestation verify oci://ghcr.io/modelcontextprotocol/inspector:<version>
+        # --repo modelcontextprotocol/inspector` passed on 2.5.0 without the
+        # second scope. `artifact-metadata: write` persists the separate
+        # *storage record*: GitHub's org-level index of where a published
+        # artifact lives (registry, active/eol status), surfaced at
+        # https://github.com/orgs/modelcontextprotocol/artifacts. The action
+        # emits one automatically when `push-to-registry` is true AND the
+        # workflow carries this scope; with only the first condition met, every
+        # release logged two warning annotations on an otherwise-green job:
+        #
+        #   Failed to create storage record: Error: Failed to persist storage
+        #   record: no artifacts found
+        #   Please check that the "artifact-metadata:write" permission has been
+        #   included
+        #
+        # `no artifacts found` reads like it is about this job uploading no
+        # *workflow* artifact, and is not: it is the generic 404 body of the org
+        # artifact-metadata API that @actions/attest POSTs to. The same message
+        # comes back from the sibling read endpoint for 2.5.0's real digest, and
+        # from an all-zeros digest that cannot exist — so it carries no
+        # information beyond "nothing resolved", and the documented precondition
+        # we were failing is this permission.
+        #
+        # ⚠️ Confirm at the next release rather than assuming: the job should be
+        # annotation-free, and
+        # `gh api /orgs/modelcontextprotocol/artifacts/<digest>/metadata/storage-records`
+        # should return a record instead of 404. If the warning persists, the
+        # honest fix is `create-storage-record: false` plus a note here saying
+        # the record is unavailable to us — not carrying an unexplained warning.
         uses: actions/attest-build-provenance@v4
         with:
           subject-name: ghcr.io/${{ github.repository }}