security(supply-chain): generate the per-consumer approved-revision sets for the shared publish workflows #3550

🤖 Generated by the Agentic Engineer

Part of #3308 (first child).

Evidence

#3308 established the applied signing revision of all four per-consumer artifacts by observation (prod OCIRepository.status.artifact.revision → signing certificate SAN, or the tag-exact publishing run's referenced_workflows), and that each consumer's uses: pin moves on every devantler-tech/actions bump. Nothing computes the per-consumer approved set from those two inputs; report-publish-workflow-signing-revisions.sh reports the pair but emits no consumable artifact.

Audience / impact

Whoever narrows the four OCIRepository cosign matchers (#3308) needs a generated, reviewable set to narrow to; without it the set is hand-written, which #3308 rules out.

Expected

A script derives, per consumer, {applied-signer-sha, consumer-main-pin-sha} and writes a committed data file (one row per consumer, both full 40-hex revisions, the applied tag and digest they were observed on, and the observation date). Inputs: the existing report for the pin, plus the applied-revision observation — the OCIRepository status where a kubeconfig is available, falling back to the tag-exact 🚀 CD run's referenced_workflows for consumers whose package the credential cannot read. It fails closed on any consumer it cannot resolve (identity floor, as the report already does), and it changes no matcher.

Acceptance criteria

• Generated file committed; regenerating on the same inputs is byte-identical.
• Every consumer row carries both revisions; a set of one is refused with the consumer named.
• A test proves a consumer the generator cannot resolve fails the run rather than being omitted.
• No cosign subject changes in this PR.

Rough size: M.