Authenticate the signature inventory to GHCR so the two private packages resolve #3372

🤖 Generated by the Agentic Engineer

Evidence

The signature inventory shipped in #3371 runs end to end against the live fleet and reports:

rules=3 images_enumerated=128 matched=5 PASS=3 FAIL=0 UNKNOWN=2

The two UNKNOWNs are ascoachingogvaner and wedding-app. Both are private GHCR packages: an
anonymous read of the image manifest itself returns 401, so cosign's DENIED is an
authorization result and says nothing about whether a signature exists. The tool records that as
UNKNOWN by design — inventing a blast radius from an unreadable package would be exactly the
guess #3101 exists to stop.

Problem and audience

Anyone deciding whether image verification is safe to activate. #3334 closes on "a re-run reports
zero failures and zero UNKNOWNs", so those two packages are the only thing standing between the
current measurement and that condition. They are not a design problem — they are a credential the
inventory job does not yet have.

Expected outcome

The inventory-first-party-image-signatures job in
.github/workflows/validate-image-verifier-liveness.yaml authenticates to GHCR with the existing
pull credential, so both private packages resolve to a definite PASS or FAIL.

The mechanism already exists and is used elsewhere in this repository — scripts/ghcr-auth-lib.sh,
consumed by ci.yaml and scripts/run-ksail-prod-with-pull-auth.sh. This is an additive use of it,
not new design.

Acceptance criteria

• The inventory job obtains the GHCR pull credential through scripts/ghcr-auth-lib.sh rather
  than a new secret path, and the credential never reaches the job log.
• cosign verify in the tool uses that credential (registry auth), so a private first-party
  package is readable.
• A run against prod reports zero UNKNOWNs. Any image that then reports FAIL is a real
  finding and is signed or scoped under Sign or scope every first-party image that a verifier would refuse, before enforcement goes live #3334's third criterion.
• A missing or invalid credential still yields UNKNOWN and a non-zero exit — never a pass. The
  hermetic suite covers that arm.

Why this is separate

#3371 delivers the enumeration, the rule matching, the PASS/FAIL/UNKNOWN discipline and the CI
wiring, and its measurement is what identified this gap. Resolving it needs a credential decision in
a workflow rather than a change to the tool, and it is the last step before #3334 can close.

Part of #3334.