fix: harden provider and promotion evidence

scripts/contracts/promotion-artifacts.ts

@@ -1,7 +1,13 @@
-export const PROMOTED_STAGING_PATHS = Object.freeze([
-  ".release/promoted-staging/release-candidate.tar.gz",
-  ".release/promoted-staging/vulnerability-report.json",
-  ".release/promoted-staging/provenance-attestation.json",
-  ".release/promoted-staging/provider-verification.json",
-  ".release/promoted-staging/promotion-verification.json",
+export const PROMOTED_FILE_NAMES = Object.freeze([
+  "release-candidate.tar.gz",
+  "vulnerability-report.json",
+  "provenance-attestation.json",
+  "provider-verification.json",
+  "promotion-verification.json",
 ] as const);
+
+export type PromotedFileName = (typeof PROMOTED_FILE_NAMES)[number];
+
+export const PROMOTED_UPLOAD_PATHS = Object.freeze(
+  PROMOTED_FILE_NAMES.map((name) => `\${{ steps.finalize.outputs.staging_root }}/${name}`),
+);