fix(ci): pin the organization on attestation init in GitHub workflows
Attestations authenticating via OIDC could resolve an organization other than the intended one, causing several workflow runs to fail.
chainloop attestation init now receives an explicit --org chainloop in all GitHub workflows that craft attestations, which pins the organization for the whole attestation lifecycle. Only init needs the flag: the organization is persisted afterwards, so the remaining add/push/reset commands resolve it on their own.
Workflows updated: author verification, codeql, helm chart packaging, release (release gate and release jobs), SCM configuration check, and the daily secrets scan.
Note that scorecards.yml is not covered here, since it delegates attestation crafting to a reusable workflow in chainloop-dev/labs that does not expose an organization input.
Resolves PFM-6860.
AI disclosure: this change was produced with the assistance of Claude Code.