.github/workflows/release-bazel: disable attestation

The bazel attestations are too complicated for mortals like me.
Also, the yanked_versions list is ignored in
metadata.template.json, so delete its content.

Change-Id: I28e05de4ca3391fd9c87189ff3be3aeedea95ac4
Reviewed-on: https://code-review.googlesource.com/c/re2/+/63971
Reviewed-by: Alan Donovan <adonovan@google.com>
Reviewed-by: Russ Cox <rsc@swtch.com>

.bcr/metadata.template.json

@@ -12,9 +12,5 @@
       "github:google/re2"
   ],
   "versions": [],
-  "yanked_versions": {
-      "2023-06-02": "bad compatibility_level, upgrade to 2023-09-01 or newer",
-      "2023-08-01": "bad compatibility_level, upgrade to 2023-09-01 or newer",
-      "2025-06-26": "accidentally lost from github, upgrade to 2025-07-22 or newer"
-  }
+  "yanked_versions": {}
 }

.github/workflows/release-bazel.yml

@@ -20,11 +20,19 @@ jobs:
   release:
     uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v0.2.2
     with:
+      draft: false
       tag_name: ${{ inputs.tag_name }}
-      # This workflow seems to require keeping a fork of the upstream to open
-      # PRs from.
       registry_fork: re2-machine/bazel-central-registry
-      attest: true
+      # NOTE: To use attest: true, we need a signed intoto.jsonl file,
+      # but that appears to require using
+      # the release_ruleset support described on
+      # https://github.com/bazel-contrib/publish-to-bcr?tab=readme-ov-file#attesation-support
+      # but that requires a release_prep.sh file,
+      # and an override on the test command,
+      # and may insist on doing the release upload of the source zip
+      # (which we do ourselves separately),
+      # and possibly more problems I didn't hit because I gave up.
+      attest: false # too hard to generate the intoto.jsonl file
     permissions:
       contents: write
       id-token: write