chore(ci): normalize and align CD pipeline

[nanotaboada]

Summary

Improve the CD pipeline: extract a dedicated test gate before deployment, add uv dependency caching, enable build provenance attestation, and tighten changelog generation.

Changes

Structure

• Extract a dedicated test job (currently tests run inside release)
• Add needs: test to release job
• Add id-token: write and attestations: write permissions to release job

Test job steps

• Checkout repository
• Set up Python
• Set up uv — add enable-cache: true (dependency caching missing in CD, present in CI)
• Install test dependencies
• Run tests with pytest

Release job

• Set provenance: false → provenance: mode=max
• Add actions/attest-build-provenance@v4.1.0 step after image push with push-to-registry: true
• Add --no-merges flag to changelog git log
• Add empty changelog guard: No new changes since $PREVIOUS_TAG when a previous tag exists, No changes (first release) otherwise
• Drop Quick Start section from release body (belongs in README)

Acceptance Criteria

• CD triggers on v*.*.*-* tags and completes successfully
• test job fails fast if tests fail before any image is pushed
• Docker image published for both linux/amd64 and linux/arm64
• Build provenance attestation appears on the GitHub Release
• Changelog excludes merge commits

[coderabbitai]

🔗 Related PRs

#351 - feat(ci): update workflow to build and push Docker image to GHCR [merged]
#469 - feat: implement tag-based releases with football coaches naming (#467) [merged]
#481 - docs: standardize release workflow and improve documentation quality [merged]
#501 - chore(deps): migrate to uv with PEP 735 dependency groups (#447) [merged]
#526 - chore(config): remove stale assets/ folder references [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!