feat: verify frontend supply chain

config/ci/gates.json

@@ -58,7 +58,10 @@
   "gates": {
     "FE-GATE-001": {
       "name": "manifest-lockfile",
-      "steps": [{ "script": "verify:lockfile", "expect": "pass" }],
+      "steps": [
+        { "script": "verify:lockfile", "expect": "pass" },
+        { "script": "check:frozen-lockfile:fixture", "expect": "pass" }
+      ],
       "logPath": "artifacts/quality/install.txt",
       "evidence": ["artifacts/quality/install.txt"],
       "retentionClass": "merge-cycle"
@@ -239,14 +242,32 @@
     "FE-GATE-013": {
       "name": "security",
       "steps": [
+        { "script": "verify:reproducible-build", "expect": "pass" },
         { "script": "build:release", "expect": "pass" },
+        { "script": "verify:supply-chain", "expect": "pass" },
+        { "script": "check:supply-chain:fixtures", "expect": "pass" },
+        {
+          "script": "check:supply-chain:provider-fixtures",
+          "expect": "pass"
+        },
+        { "script": "scan:security:fixture", "expect": "fail" },
         { "script": "check:browser-security", "expect": "pass" }
       ],
       "logPath": "artifacts/quality/gates/FE-GATE-013.txt",
       "evidence": [
         "artifacts/security/scan.sarif",
+        "artifacts/security/scan-fixture.sarif",
         "artifacts/release/dependency-inventory.json",
-        "artifacts/security/dependency-diff.json"
+        "artifacts/release/sbom.cdx.json",
+        "artifacts/release/provenance.json",
+        "artifacts/release/reproducible-build.json",
+        "artifacts/security/dependency-diff.json",
+        "artifacts/security/license-report.json",
+        "artifacts/security/vulnerability-report.json",
+        "artifacts/security/supply-chain-verification.json",
+        "artifacts/security/supply-chain-coherence.json",
+        "artifacts/security/supply-chain-fixtures.json",
+        "artifacts/security/supply-chain-provider-fixtures.json"
       ],
       "retentionClass": "release-coherence"
     },
@@ -260,11 +281,15 @@
     "FE-GATE-015": {
       "name": "release-coherence",
       "steps": [
-        { "script": "build", "expect": "pass" },
-        { "script": "verify:release", "expect": "pass" }
+        { "script": "build:release", "expect": "pass" },
+        { "script": "verify:release", "expect": "pass" },
+        { "script": "verify:supply-chain:promotion", "expect": "pass" }
       ],
       "logPath": "artifacts/quality/gates/FE-GATE-015.txt",
-      "evidence": ["artifacts/release/verification.json"],
+      "evidence": [
+        "artifacts/release/verification.json",
+        "artifacts/security/promotion-verification.json"
+      ],
       "retentionClass": "release-coherence"
     },
     "FE-GATE-016": {