M0.9: verify provenance and SBOM attestations

[pgousdal]

M0.9

Strengthen release supply-chain qualification beyond M0.8's attestation-manifest count.

Acceptance criteria

• map each required linux/amd64 and linux/arm64 platform digest to its BuildKit attestation manifest
• require attestation-manifest reference metadata to point to the exact platform digest
• require in-toto attestation layers
• require non-empty SLSA provenance descriptor (https://slsa.dev/provenance/v0.2)
• require non-empty SPDX SBOM descriptor (https://spdx.dev/Document)
• require sha256 layer digests
• exercise the gate against the already-published v0.2.1 release on pull requests
• run automatically on future release tags and support manual qualification of immutable releases

This milestone intentionally does not claim cryptographic signer identity verification; that remains a separate future supply-chain milestone.