#2388 build-attestation hashes workflow files at the commit, not the workflow each run evaluated

scripts/build_attestation.ts computes configIntegrity by running git show on each workflow and config file at the verified commit (showAtCommit, around lines 764-786). It never compares those files with the workflow each run actually executed, which swamp records at .swamp/workflows-evaluated/runs/RUN_ID/evaluated-workflow.yaml.

How they diverge: the documented command uses a relative SWAMP_WORKFLOWS_DIR=verification. Run from a worktree with --repo-dir pointing at the main checkout (the recommended way to run swamp in a worktree), the relative dir resolves against the main checkout, so the runs load the main checkout's verification YAML rather than the branch's. The run records still carry the branch commit, so build-attestation's commit binding passes, and configIntegrity reports hashes of the branch's files, which the runs never executed.

Observed while verifying swamp-club#2387, a PR that edits verification/workflow-verify-*.yaml: runs 2a1e6410, e828ccd5 and 017966bd executed the unfixed YAML from the main checkout. It was noticed only because verify-reviews failed. Had all three passed, the attestation would have claimed the fixed workflows were verified.

Possible fixes: have build-attestation hash (or compare against) each run's evaluated workflow and refuse on mismatch; and/or document an absolute SWAMP_WORKFLOWS_DIR in verification-conventions.md.