fix(ci): correct gh release upload flag order in SLSA workflow (#691)

`--clobber` came after the `--` separator, so gh parsed it as a filename
('no matches found for --clobber') and the build-artifacts job failed,
skipping provenance. Move --clobber before -- so it is a flag and the
glob stays positional.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: blove

.github/workflows/release-provenance.yml

@@ -44,7 +44,7 @@ jobs:
       - name: Upload tarballs to the release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release upload "${{ github.event.release.tag_name }}" -- release-artifacts/*.tgz --clobber
+        run: gh release upload "${{ github.event.release.tag_name }}" --clobber -- release-artifacts/*.tgz
 
   provenance:
     needs: [build-artifacts]