v2026.3.18 release notes provide incorrect pathway to disable github_attestations for python

[spy-aaron]

From the release notes for v2026.3.18:

# settings.toml or mise.toml [settings]
[python]
github_attestations = true  # defaults to the global github_attestations value

This does not work in disabling attestations.

Instead requires:

[settings]
python.github_attestations = false

[carlosjgp]

Also

disabling attestations doesn't work with lockfiles

core:python@3.12.3: Lockfile requires github-attestations provenance for core:python@3.12.3 but no verification was used. This may indicate a downgrade attack. Enable the corresponding verification setting or update the lockfile.

and mise lock doesn't provide them... so we need to disable lockfiles all together