fix: promote immutable verified release bundles

docs/security/supply-chain.md

@@ -19,8 +19,8 @@ The canonical commands are:
 ```bash
 corepack pnpm verify:lockfile
 corepack pnpm verify:reproducible-build
-corepack pnpm build:release
-corepack pnpm verify:supply-chain
+corepack pnpm build:release-candidate
+corepack pnpm verify:local-evidence
 corepack pnpm check:supply-chain:fixtures
 ```
 
@@ -31,16 +31,19 @@ rejected.
 
 ## External promotion controls
 
-The vulnerability adapter reads the file named by
-`VULNERABILITY_REPORT_PATH`. It requires a provider, the exact lockfile digest,
-severity findings and valid independent, unexpired exception evidence.
-`PROVENANCE_ATTESTATION_PATH` must name a provider, signer and the exact built
-dist subject digest.
+Promotion reads the provider files named by `VULNERABILITY_REPORT_PATH` and
+`PROVENANCE_ATTESTATION_PATH`. The vulnerability report must bind both the
+exact lockfile digest and candidate `distSha256`; the provenance attestation
+must name `dist` with that same digest. Both documents use strict schemas and
+Ed25519 signatures verified with separately configured trusted public keys and
+key IDs.
 
 If either provider input is absent, local verification remains meaningful but
 `artifacts/security/supply-chain-verification.json` records
-`promotionStatus: FAIL_UNVERIFIED`. `verify:supply-chain:promotion` then exits
-non-zero. Scanner or signing outages are not converted to an empty PASS.
+`promotionStatus: FAIL_UNVERIFIED`. `verify:provider-evidence` and
+`verify:promotion` then exit non-zero. Promotion recomputes the candidate file
+set and digests and never rebuilds it. Scanner or signing outages are not
+converted to an empty PASS.
 
 Approved vulnerability exceptions require vulnerability/package identity,
 owner, a different reviewer, reason and expiry. Expired or self-approved