fix(ci): address review findings in CD pipeline

- Add attestations: write permission required by attest action
- Add push-to-registry: true to push attestation to GHCR
- Fix empty changelog fallback message when PREVIOUS_TAG is unset

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: nanotaboada

.github/workflows/maven-cd.yml

@@ -37,6 +37,7 @@ jobs:
             contents: write
             packages: write
             id-token: write
+            attestations: write
 
         steps:
             - name: Checkout repository
@@ -108,6 +109,7 @@ jobs:
               with:
                   subject-name: ghcr.io/${{ github.repository }}
                   subject-digest: ${{ steps.push.outputs.digest }}
+                  push-to-registry: true
 
             - name: Generate changelog
               id: changelog
@@ -121,7 +123,11 @@ jobs:
                   fi
 
                   if [ -z "$CHANGELOG" ]; then
-                    CHANGELOG="No new changes since $PREVIOUS_TAG"
+                    if [ -n "$PREVIOUS_TAG" ]; then
+                      CHANGELOG="No new changes since $PREVIOUS_TAG"
+                    else
+                      CHANGELOG="No changes (first release)"
+                    fi
                   fi
 
                   {