feat(sign): optional detached minisign signature over the evidence bundle (J1)

[henleda]

Roadmap J1. manifest.json already SHA-256s every member, so tampering with a member is
detectable from inside the bundle. What it could not do is bind the bundle to whoever produced it —
generated_by / generated_on are unauthenticated strings anyone can edit.

sign.py signs the manifest and drops manifest.json.minisig beside it. Because the manifest
digests every member, coverage is transitive.

Three design calls

Shell out to minisign, add no dependency. export.py stays stdlib-only — which J2's
acceptance also requires — and a reviewer verifies with a one-line command whether or not they have
this toolchain installed.

Optional at every level. No key configured, no binary on PATH, an unreadable key, a signer that
exits non-zero, a signer that hangs — each logs one line and exports unsigned. An evidence bundle
that refuses to be produced for want of a signing key is worse than an unsigned one.

No passphrase handling. The key must be unencrypted (minisign -G -W). A signing passphrase is
a credential this tool has no business holding; requiring a key managed by whatever already manages
your secrets is the honest trade, documented rather than discovered at a prompt.

It signs the bytes that actually ship

Signing a different serialization than the member in the zip would make every verification fail —
or, worse, pass against something the reviewer never received. Pinned by a test that captures what
the signer was handed and compares it byte-for-byte to manifest.json in the bundle.

The bundle carries its own limits

A caveat — true whether or not a signature is present — travels inside the manifest:

If manifest.json.minisig is present it signs THIS manifest, which SHA-256s every member — so it
attests who exported the bundle, not that the audit log inside is truthful. Verify it with the
signer's public key obtained out of band; a key shipped inside a bundle proves nothing about
that bundle.

docs/USAGE.md spells out generation and verification, and states plainly what the signature does
and does not attest.

Verification status — one gap, deliberately left for you

10 new tests, all offline against a stub minisign on PATH, covering every failure path and the
signed-bytes-match-shipped-bytes guarantee. 278 pass · coverage 73% · ruff clean.

What the stub cannot check is my CLI flag contract (-S -s <key> -m <in> -x <out> -t <comment>)
against the real binary — the stub validates it against my own assumption. minisign is not
installed here and I did not want to change your machine unasked. brew install minisign and I'll
do a real keygen → sign → verify round-trip and push the result to this branch before you merge.

🤖 Generated with Claude Code