ci(sign): keyless signing leg (default off) + zero-prod-contact rehearsal

[robinnsc]

What

Draft — staged rollout; merging changes zero production behavior.

1. The sign-image composite action gains a keyless input (default
   false): when enabled, cosign exchanges the job's OIDC token for a
   short-lived Fulcio certificate bound to the workflow run's identity and
   signs additively — the keyless signature lands as another layer on
   the same tag-based .sig artifact, next to the KMS signature, per the
   recorded dual-signing decision. key-arn becomes optional (empty skips
   the keyed leg — rehearsal use only).
2. A keyless-rehearsal workflow proves the entire path with zero
   production contact: scratch image in a dedicated GHCR package, signed
   through the production composite action, then — certificate identity
   captured from the signature itself, artifact shape asserted against the
   mirror/promote gate requirements, verification by identity, and a
   wrong-identity negative control.

Infrastructure changes required

None. No AWS (KMS untouched; dual-signing keeps it), no new GitHub
environments or secrets: Fulcio needs id-token: write (signing jobs
already carry it), Rekor reachability from runners is proven since v0.1.8.
The trust infrastructure is Sigstore's public instance — which is also the
honest caveat: keyless verification depends on Fulcio/Rekor availability
and TUF roots, which is why the KMS signature remains the air-gap answer.

Why keyless

Ends public-key distribution (verify by identity, not by PEM), and
resolves the documented one-key caveat: dev and postgres images are
signed by different workflows, so identity-based verification distinguishes
image tiers natively — something key-based verification cannot do.

Rollout plan (the high-confidence gate)

• A. Merge (inert — flag off everywhere).
• B. Dispatch keyless-rehearsal repeatedly (it is cheap and
  credential-free). It empirically pins the cosign v3 flag set for
  keyless + tag-based storage on real runners — the exact class of flag
  interaction that produced the ECR storage-mode incident — and prints the
  ACTUAL certificate identity strings.
• C. From the captured identities: write the verify documentation and
  admission-policy guidance (identity per workflow = per image tier).
• D. One-line keyless: 'true' in release-image /
  release-dev-image (separate trivial PR). First dual-signed release
  verifies both ways; nothing existing changes — cosign verify --key
  continues to pass against the KMS layer, so the drift verifier, all
  runbook procedures, and every published instruction remain valid.

Testing done

• yaml.safe_load on both files; the keyless step reuses the pinned,
  checksum-verified cosign install and the validated annotation handling.
• Deliberately not claimed: that the keyless flag set is correct — that
  is what the rehearsal exists to establish on real runners before any
  production caller enables the flag. The action's keyless leg self-checks
  (verify-by-identity) and the rehearsal adds the negative control, so a
  wrong flag set fails loudly in rehearsal, not in a release.

Checklist

• Tests / fmt / clippy — not applicable, CI only
• Added or updated tests — the rehearsal (with negative control) is the test, run pre-enablement by design
• Documentation — headers document semantics; verify docs come in phase C from captured identities
• Breaking changes noted below

ADR / RFC: n/a — CI tooling; the signing-model decision (dual, additive) is already recorded in the release runbook.

Breaking changes

None. Default-off; the keyed signature and all existing verification paths are unchanged.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache License 2.0 and I agree to the Developer Certificate of Origin (DCO). See CONTRIBUTING.md for details.