fix(action): classify gh's real denial stderr as contradicted, not unavailable

[SollanSystems]

The same-day correction slice 4b's plan mandated, closing the M2 fixture pair with a real
vendor string instead of a paraphrase. Follows #110.

What the post-merge experiment falsified

#110's first attest.yml run (30509952627)
succeeded on the first attempt, and the D1 prediction held both ways — subject[0].digest.sha256
(6530115e…) is not predicate.chain.head (3f0aa6d5…) and is sha256(<the 64 head bytes>). The pinned certificate claim names were right too: all three of
REQUIRED_CERTIFICATE_CLAIMS are present, and both _TRIGGER_CLAIM_ALIASES
(githubWorkflowTrigger and buildTrigger) are present, so the fail-closed
"at least one" rule was satisfied twice over. No correction needed there.

One thing was wrong. Now that a verifiable attestation exists, the denial-shape stderr
could finally be captured — it could not be before, because no attestation this repo had
minted was verifiable at all. Verbatim, from live gh with a deliberately wrong
--signer-workflow:

Error: verifying with issuer "sigstore.dev"

No marker in _CONTRADICTED_MARKERS matched it. The classifier's fail-closed default
therefore reported the most common denial as anchor_attestation_unavailable.

Why this matters, and why it is not a security hole

Both outcomes are non-promoting and both exit 1, so nothing was ever promoted that should
not have been — the fail-closed default did its job. What broke is D5's observability
distinction, in the more misleading direction: "I looked and it said no" was being
reported as "I could not look." An operator reading that log would go looking for an
index outage instead of an unexpected signer.

The pre-merge marker set was a remembered approximation of a vendor string. That is exactly
the failure mode the plan's M2 fixture requirement exists to catch — "a test author's
remembered approximation of a vendor message is exactly the thing that passes review and
fails in production" — and it is why the denial fixture was scheduled for capture the
moment it became possible.

The fix

• "verifying with issuer" added to _CONTRADICTED_MARKERS, ahead of the pre-merge
  guesses. Ordering is unchanged and still safe: the "nothing found / transport" markers are
  checked first, so a 404 cannot be misread as a denial.
• scripts/fixtures/gh_attestation_verify/signer_denied.txt — the 45-byte verbatim capture.
• test_resolve_classifies_the_real_captured_denial_stderr drives the classifier from that
  file and asserts contradicted. Verified to fail with the marker removed, so it is not
  a vacuous pin.

The M2 fixture pair is now complete: both the 404 branch and the denial branch are pinned
against real captured gh output.

Suite (fresh tmpfs worktree): 1568 passed / 18 skipped canonical
(pyyaml+jsonschema+pytest), 1469 passed / 117 skipped structural-fallback.
scripts/test_action_anchor_resolve.py 24 passed. No version bump.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.