feat(s131): signing, provenance, SBOM and AI-BOM for the headless image

[HackTuah]

Slice 131: signing, provenance, SBOM and AI-BOM for the headless image. Stacked on #117 (slice 130): this PR's base is 130's branch. Merge #117 first.

The slice stays in_progress. The publish job has never run: it needs the project's signing key and a green image job, and the image job needs the OTP bump. The AI-BOM's run on the real image waits on #119 and the legal review (D7).

What lands

• Held-key signing (cosign P-256; KMS or PKCS#11 key references work), with no transparency log, so a disconnected or classified site needs only the public key.
  • The cost: a stolen key signs silently.
  • The mitigation: one job holds the key, and GitHub's logged platform provenance is requested beside it.
• SLSA v1 provenance: names the builder, the repository, the commit, every manifest resource and both bases by digest. An image without a matching revision is refused.
• SBOM attestation: mix trinity.sbom for the same commit, matched on the image.
• CycloneDX 1.6 ML-BOM: weights digest, licence, training datasets with their terms quoted, the risk and the legal review status, and the embedding space's manifest. It lists no models until 133 merges and D7 clears.
• Build L1, with the reason it is not L2. A check fails if the claim outruns the mechanism.
• docs/regulated/image-verify.md: offline verification a stranger runs with cosign, jq and sha256sum. Each step has its own exit status, and the tests and the workflow run that exact block.
• The publish job: after a fully green image job, on main, a v* tag or by hand.

Two cosign behaviours, measured and checked around

• cosign verify --key passes an image that carries only an attestation and no signature.
• cosign does not check layer blobs: a tampered layer verifies. The documented sequence exits 10 there, where cosign verify alone exits 0.

Criteria

• Proven: AC1 to AC6 and AC8. AC1, AC2 and AC3 were also run on a clean build of the real hardened image, signed and verified offline.
• Partly proven: AC7, on a fixture; the run on the real image is held.

Evidence

• Author's gate: exit 0, 1097 passed (20 properties, 1077 tests), 30 excluded, prod_check: PASS, coverage 80.70%.
• Reviewer re-run before commit:
  • the 4 new test files: 53 passed, 12 excluded;
  • --only image_signing with real cosign: 12 passed;
  • mix format --check-formatted OK; mix credo --strict --all found no issues;
  • no private key material in the diff.

A 130 defect this found

F-131-2: scripts/headless_image.sh build TAG failed after a successful build ("dir: unbound variable"), and the workflow calls it exactly that way. It is reproduced in isolation and fixed on #117 itself as fix(s130), merged in here.

Owner actions

1. Generate the signing key pair. Store COSIGN_PRIVATE_KEY and COSIGN_PASSWORD as repository secrets, commit the public half as ci/headless/cosign.pub, and make the GHCR package public.
2. Approve the OTP 28.5.0.7 bump.
3. Commission the D7 legal review.