fix(release): align verify gate to emitted collection name + native attestor types

[colek42]

The release verify gate has never passed because cilock verify could not select the build collection as a policy candidate. Two independent bugs, both hidden behind the same misleading ErrNoCollections message ("no subjects matched ... supply inclusion-proof sidecar", which wrongly blames the Merkle bridge):

Bug 1 — collection-name / step-name mismatch

The dogfood ran with --step "release-build-<os>-<arch>", naming the collection release-build-linux-amd64, but the policy has a single step release-build. source.Search keys on referencesByCollectionName[stepName] (exact match), so searching for step release-build returned zero collections. This is the failure that fired first in rc1–rc6 — the error literally said "for step release-build". Fixed by naming the collection release-build for every platform; per-arch distinction stays in the -o outfile.

Bug 2 — required attestation-type mismatch

The policy required witness.dev/attestations/commandrun/v0.1, but the attestor is spelled command-run (hyphenated) in both namespaces — commandrun aliases to nothing, so MemorySource.matchesAttestations filtered the collection out even once names matched. All required types are now the aflock.ai-native URIs the binary actually emits (git, github, command-run, product/v0.3), removing all dependency on the legacy alias bridge.

Also: github-step rego was silently vacuous

It read top-level input.repository / input.reftype, which do not exist on the github attestor — the real fields are input.jwt.claims.repository / input.jwt.claims.ref_type. (It never ran before because rc1–6 failed earlier.) Rewritten to read those, fail-closed on missing fields, kept in v0 rego syntax (cilock evaluates via the legacy opa/ast path = RegoV0; v1 deny contains msg if would fail to parse).

Verification (against the real rc6 platform-signed attestation)

• Candidate selection goes 0 → 1 with the combined fix (differential: command-run → 1 candidate, commandrun → 0; real step name release-build → 1 only after both fixes).
• Signer cert Fulcio extensions (Issuer / SourceRepositoryURI / BuildConfigURI) match the functionary constraint.
• Rego passes the legitimate release; denies wrong-repo, non-tag, and missing-field inputs (validated with opa eval and a cilock-legacy-ast parse probe).

🤖 Generated with Claude Code