ci: publish the provenance bundle, and add a second reader on pull requests

[donislawdev]

Steps 1 to 3 of the agreed plan. Step 4 (a conditional approving review) waits for a
real cost datapoint from step 3; steps 5 and 6 (the two-phase signed release, and the
ruleset change) come after.

The provenance bundle now ships as an asset

Both attestations lived only in GitHub's attestation store. That is enough for
gh attestation verify <zip> -R <repo> and not enough for anyone holding the download
with no path to that API, or anyone who took the files from a mirror. The release now
uploads BeanNetworkTester-<tag>.sigstore.json, and --bundle verifies offline.

🔴 Why it was worth finding: OpenSSF Scorecard's Signed-Releases check reads release
assets by file extension and never opens the attestation store, so it scored 0/10 on
releases that already carried two signed statements. Read in probes/releasesAreSigned
and probes/releasesHaveProvenance, not guessed.

The asset is .sigstore.json because that is what the action writes. .intoto.jsonl
would score two points higher on that check and is a different format, not another name
for this one. And the check scores floor(sum / releases) over the last five
releases, so the first signed release scores 2, not 10 - worth knowing before reading
that number as a failure.

A second reader on pull requests

Four analysers read the code for shapes. This reads the change for meaning, with a
context the session that wrote it does not have. It comments; it cannot fail a pull
request.

The trigger is the cost control, not the model. opened and ready_for_review
only, never synchronize - that one fires on every push and would multiply the bill by
how often a branch is amended. The cost of the choice is stated rather than hidden: a
problem introduced by a later push is not seen, and a fresh pass is asked for with a
comment.

Three locks on who can spend it: the condition in the workflow, the action's own refusal
of actors without write access and of bots, and GitHub withholding secrets from fork
pull requests in a public repository. The job holds no write permission.

🔴 The part that needed finding: CLAUDE.md is git-ignored here, so a runner checks
out a tree without it. The review would arrive knowing none of this repository's rules
and would spend its findings on what CI already enforces.
.github/claude-review-rules.md is a public digest of those rules - every line already
in CONTRIBUTING and the READMEs - copied into place for the length of the run. Without
that step the job still succeeds, just uselessly, which is why it is guarded: a
wasted run is harder to notice than a red one.

Testing policy

CONTRIBUTING.md said the policy twice as examples and never as a policy. It now says
it once and names what enforces it.

Verification

• Full suite, GUI smoke, ruff, mypy: green on these changes.
• Two mutations, both caught on the first run: the bundle dropped from the publish
  command, and synchronize added back to the review trigger.
• The existing attestation guard was silently reading only the first line of the
  publish command, which now spans lines. Fixed in the same commit.

⚠️ Unrelated: a property-based test, test_describe_reparses_to_the_same_matcher,
found a genuine round-trip defect in the filter mini-language while this branch was
being verified. It predates these changes and touches none of them, but it may redden
the test job here. It is being handled separately rather than folded into this branch.

What this needs on the repository side

The Claude GitHub App installed, and a CLAUDE_CODE_OAUTH_TOKEN secret. Until both
exist the review job fails on authentication rather than doing anything unexpected.

🤖 Generated with Claude Code