Delete the provenance-backfill release path

[krisarmstrong]

Summary

release.yml carries a provenance_only backfill path — two workflow_dispatch
inputs, a goreleaser-backfill-hashes job, and a branch in three separate
conditions — whose only purpose is to retro-attest releases that shipped before
the provenance job existed.

It should go.

It has not been used since 2026-05-19, and the releases it exists for are
still unattested:

$ gh release view v0.185.11 --json assets --jq '[.assets[].name|select(test("intoto"))]|length'
0
$ ... v0.186.0  -> 0
$ ... v0.186.2  -> 0

Every workflow_dispatch release run since then shows the backfill job as
skipped. So it is not pending work; it is abandoned work, and its intended
output never materialised.

Backfilled provenance is also a weaker claim than the real thing. The job
reads a published checksums.txt and attests those hashes. That says "these are
the hashes in the file we published", not "this build produced these artifacts
from this source" — which is what provenance is for. For pre-v1.0 releases with
no external consumers, it is ceremony.

Meanwhile it is the single largest source of branching in a workflow that has
just been through a security fix (the publish bypass): every condition in the
file has to account for a third mode, and the contract guard has to model it.

Per the repository's own pre-alpha rule — no grandfathering, no shims, delete
and replace — and with the owner confirming the old releases will not be
backfilled, the path should be removed. It stays recoverable from git history.

Expected

provenance_only and target_tag inputs, the backfill job, and every condition
branch that references them are gone. Publishing, snapshotting and attesting are
decided by two facts only: is this a pushed tag, and is it a dry run.