fix: harden provider and promotion evidence

scripts/generate-ci-workflow.ts

@@ -131,6 +131,16 @@ function renderJob(
       `      ${archive.archiveOutputName}: \${{ steps.${archive.stepId}.outputs.${archive.archiveOutputName} }}`,
     );
   }
+  if (job.kind === "provider") {
+    const supervisor = job.steps.find((step) => step.kind === "run-provider");
+    if (!supervisor || supervisor.kind !== "run-provider") {
+      throw new TypeError("provider job lacks supervisor step");
+    }
+    lines.push(
+      "    outputs:",
+      `      invocation_nonce: \${{ steps.${supervisor.stepId}.outputs.invocation_nonce }}`,
+    );
+  }
   if (job.environment.length > 0) {
     lines.push("    env:");
     for (const binding of job.environment) {
@@ -229,6 +239,7 @@ function renderStep(
     case "run-provider": {
       return [
         `      - name: Run and validate external ${step.provider} provider in one trusted supervisor`,
+        `        id: ${yamlKey(step.stepId)}`,
         `        run: node scripts/run-and-validate-provider.ts --kind ${step.provider}`,
       ];
     }
@@ -240,8 +251,23 @@ function renderStep(
     case "verify-promotion":
       return [
         "      - name: Finalize verified promotion from inode-bound captured inputs",
+        `        id: ${yamlKey(step.stepId)}`,
         "        run: node scripts/stage-verified-promotion.ts",
       ];
+    case "cleanup-promotion":
+      return [
+        "      - name: Always remove private promotion staging",
+        "        if: always()",
+        "        env:",
+        `          PROMOTION_STAGING_ROOT: \${{ steps.${step.finalizerStepId}.outputs.staging_root }}`,
+        `          PROMOTION_CLEANUP_TOKEN: \${{ steps.${step.finalizerStepId}.outputs.cleanup_token }}`,
+        `          PROMOTION_RUNNER_TEMP_DEV: \${{ steps.${step.finalizerStepId}.outputs.runner_temp_dev }}`,
+        `          PROMOTION_RUNNER_TEMP_INO: \${{ steps.${step.finalizerStepId}.outputs.runner_temp_ino }}`,
+        "        run: |",
+        '          if [ -n "$PROMOTION_STAGING_ROOT" ] && [ -n "$PROMOTION_CLEANUP_TOKEN" ]; then',
+        "            node scripts/cleanup-verified-promotion.ts",
+        "          fi",
+      ];
     case "upload": {
       const lines = [
         `      - name: Upload ${humanize(step.transferId)}`,