ci: fix the attestation step

The path is incorrect because we meant to capture the value of
`$PWD` before running `popd`.

Author: malor

.github/workflows/release.yml

@@ -100,9 +100,8 @@ jobs:
             tar cvzf $ASSET_NAME xsnippet-api
           fi
           gh release upload $RELEASE_TAG $ASSET_NAME
-          popd
-
           echo "asset_path=$PWD/$ASSET_NAME" >> $GITHUB_OUTPUT
+          popd
         env:
           ASSET_NAME: ${{ matrix.name }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}