Record the published jars as linked artifacts

[tonytonycoder11]

Fills the Packages panel that has been empty since #49, with something quite different from what #49
removed. GitHub Packages was a second distribution channel: it hosted copies of the jars, needed a
token to resolve, and had to be kept green at every release. A linked artifact hosts nothing — it
records that this repository built this jar, that the jar lives on Maven Central, and that the
attestation from #47's provenance work proves the two are the same file. Both are keyed on the
artifact digest, so they compose.

Verified before writing the step

• The endpoint is live on this organisation. GET /orgs/NaCode-Studios/artifacts/{digest}/metadata/storage-records
  answers no artifacts found with the artifact-metadata documentation_url — the endpoint exists and
  has no records, which is not the same as the endpoint not existing.
• There is no DELETE endpoint in the documented set. A storage record is permanent, which is why
  this records only the six main jars and not their sources and javadoc siblings.
• The digest keying works end to end: kdrant-core-1.2.0.jar downloaded from repo1.maven.org hashes
  to sha256:ea487ed5…, the same digest the build produced, and that digest already resolves to one
  in-toto attestation on this repository.

Left open on purpose

Whether the workflow's GITHUB_TOKEN may write to an organisation-level endpoint is not documented —
the docs state artifact-metadata:read for reading and say nothing about writing. The first tagged
release after this merges answers it. The step runs after the publish, so a failure means the metadata
is missing rather than the release being broken, and a red run is the right way to learn that. If a PAT
turns out to be required it becomes the first secret added for this, which is worth knowing rather than
guessing.

One difference from Kmemo

Kmemo starts at its 1.2.0 because that release has not happened yet, so provenance and storage record
land in the same workflow run. Kdrant's 1.2.0 is already out — it is our first attested release, and
this step will not reach it, because the workflow only runs on a tag push. So 1.3.0 onward is
automatic, and 1.2.0 needs a decision: backfill its six records by hand, or start the page at 1.3.0.
Nothing in this PR does the backfill.