docs: fix SPDX attestation verification

[gnanirahulnutakki]

Summary

Consumer verification of the first public release proved that GitHub emits the vetted SPDX predicate URI as https://spdx.dev/Document/v2.3. The runbook used the unversioned URI, so gh attestation verify found no matching predicate even though the attached SBOM attestation was valid.

This change corrects the command and adds a regression assertion for the exact SPDX 2.3 predicate URI.

Evidence

• corrected offline SBOM verification succeeds against the v0.1.0 darwin/arm64 bundle
• direct Cosign checks for archive, SBOM, checksums, and formula pass
• online and attached-bundle SLSA verification pass
• extracted binary reports version 0.1.0, release commit 5e50168, Go 1.26.5, and darwin/arm64
• targeted race test and golangci-lint pass

Refs #27

[gnanirahulnutakki]

Consumer verification and regression review complete. The corrected SPDX 2.3 predicate verifies against the attached v0.1.0 bundle. Race instrumentation now skips only the wall-clock microbenchmark; the independent non-race 100 ms gate remains unchanged and green. Remote full product/kind and reproducible-release jobs pass.