feat(ci): sign, describe and scan what we publish

[nikzen]

Everything we publish now says where it came from, and can be checked against
what it says.

• Provenance. OCI annotations for repository, commit and ref on every
  image. No created timestamp, deliberately: it would make two builds of one
  commit differ.
• Contents. An SPDX document per architecture, written from the archive
  rather than the recipe, plus one from the lockfile — a compiled bundle
  carries no trace of the packages advisories are written about. grype reads
  them and reports into the run summary; ci.advisories.failOn turns that into
  a gate and is null to begin with.
• Signatures. cosign signs every digest keyless, so there is no key of
  ours to leak or rotate, and attaches each document to the digest it
  describes. The manifest list is signed too: it is what a pull by tag resolves
  to.
• Headers. The static server takes headers only from a file and had none,
  so it sent none. It now gets one generated from the same option the smoke
  test reads, so the image and the test cannot disagree. CSP stays with the
  project, since a policy that fits one application forbids another's inline
  bootstrap. crossOriginIsolation is opt-in: COEP blocks every cross-origin
  resource that does not opt in. /health for Kubernetes while we are here.
• Least privilege. Jobs start at contents: read; the two that publish ask
  for more and stand out for it. Every job has a timeout, because a runner
  waiting for something that never comes holds a queue for six hours. The
  checkout no longer leaves its token in .git/config.
• Releases. A version tag turns the matching changelog section into release
  notes, marking a suffixed version as a prerelease. An empty section falls
  back to GitHub's commit summary and a warning — by the time the tag is
  pushed, the file can no longer be fixed for it.
• Cheaper arm64. The images built on an eight-core larger runner because,
  when these workflows were written, GitHub's standard arm64 runners were
  public repositories only. They reached private ones in January. Measured
  twice on both: the larger runner finishes 1.16 times faster and costs 2.8
  times the minute, and it would have to reach 2.8 to break even — half of a
  build of ours is spent fetching and unpacking, where cores buy nothing. The
  standard runner also turns out to have four cores, 15 GB and 109 GB of disk
  rather than the documented two and eight. The option stays for a project
  whose arm64 build really is compilation throughout.

Also folds in #60: vodozemac moves into nix/dart/vodozemac/, split into
source, native and web, and a web project's assets are assembled before the
build.

Not here: SLSA provenance via actions/attest-build-provenance, which needs
the action on the organisation's allow list first. Everything above runs from
the locked nixpkgs instead.

Test plan

• nix flake check --all-systems, prek --all-files --stage pre-push
• both arm64 runners measured on the same commit, two runs each: 137s and
  122s against 157s and 148s for the whole job
• famedly/famedly-control#278 exercises the rest against the nightly
  registry: labels, headers, /health, SBOM, scan report, signature and
  attestation

Made with Cursor

---

The stack

main ─┬─ #63  make room on the runner
      ├─ #59  substitute from the shared binary cache
      └─ #56  sign, describe and scan what we publish  ←
            └─ #62  keep the build directory out of vodozemac
                  └─ #61  tell a web build which build it is
                        └─ #64  let a project choose its vodozemac

#63 and #59 stand outside the chain and can land in any order. #59 and #56
both touch the vodozemac module, so whichever goes second wants a rebase.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9a0d950. Configure here.}