fix: close immutable promotion trust gaps

docs/security/supply-chain.md

@@ -36,14 +36,29 @@ Promotion reads the provider files named by `VULNERABILITY_REPORT_PATH` and
 exact lockfile digest and candidate `distSha256`; the provenance attestation
 must name `dist` with that same digest. Both documents use strict schemas and
 Ed25519 signatures verified with separately configured trusted public keys and
-key IDs.
+key IDs (`VULNERABILITY_PUBLIC_KEY_PATH`, `VULNERABILITY_KEY_ID`,
+`PROVENANCE_PUBLIC_KEY_PATH`, and `PROVENANCE_KEY_ID`). Keys of another curve,
+including Ed448, are rejected even if a document labels its algorithm
+`Ed25519`.
+
+`immutable_build` archives the raw `pnpm-lock.yaml`, `dist` (including hidden
+`.vite` files), the build manifest, module inventory, release verification,
+secret-scan result, and local supply-chain evidence once. The candidate
+manifest hashes the raw lockfile bytes and requires that digest to equal the
+dependency inventory's `lockfileSha256`. The two provider jobs download this
+same archive separately and receive `CANDIDATE_LOCKFILE_PATH` and
+`CANDIDATE_DIST_SHA256`; configured `VULNERABILITY_PROVIDER_COMMAND` and
+`PROVENANCE_PROVIDER_COMMAND` must emit the signed reports.
 
 If either provider input is absent, local verification remains meaningful but
 `artifacts/security/supply-chain-verification.json` records
 `promotionStatus: FAIL_UNVERIFIED`. `verify:provider-evidence` and
 `verify:promotion` then exit non-zero. Promotion recomputes the candidate file
-set and digests and never rebuilds it. Scanner or signing outages are not
-converted to an empty PASS.
+set and digests, then read-only revalidates the archived executable schemas,
+raw lockfile, module inventory, build outputs, release coherence, SBOM,
+provenance, security scan and supply-chain coherence. It never rebuilds or
+rewrites candidate evidence. Scanner or signing outages are not converted to
+an empty PASS.
 
 Approved vulnerability exceptions require vulnerability/package identity,
 owner, a different reviewer, reason and expiry. Expired or self-approved