fix: close immutable promotion trust gaps

scripts/generate-supply-chain.ts

@@ -8,6 +8,7 @@ import {
 
 import {
   bundlePerformanceArtifactSchema,
+  buildManifestArtifactSchema,
   dependencyDiffArtifactSchema,
   dependencyInventoryArtifactSchema,
   licenseReportArtifactSchema,
@@ -34,6 +35,7 @@ import {
   parseRepositoryFileInventoryPolicy,
 } from "./lib/repository-file-inventory.ts";
 import { collectDistOutputs, distSha256 } from "./lib/release-candidate.ts";
+import { deterministicSupplyChainGeneratedAt } from "./lib/supply-chain-time.ts";
 
 type Document = Record<string, unknown>;
 
@@ -138,6 +140,9 @@ export async function buildDependencyInventory() {
 }
 
 const packageJson = await jsonDocument("package.json");
+const buildManifest = buildManifestArtifactSchema.parse(
+  await jsonDocument("artifacts/release/build-manifest.json"),
+);
 const secretScanPolicy = documentValue(
   JSON.parse(await readFile("config/security/secret-scan-policy.json", "utf8")),
   "secret scan policy",
@@ -332,7 +337,10 @@ const verification = {
 };
 const bundleReport = {
   schemaVersion: 1,
-  generatedAt: new Date().toISOString(),
+  generatedAt: deterministicSupplyChainGeneratedAt({
+    generatedAt: buildManifest.generatedAt,
+    sourceDateEpoch: buildManifest.buildContext.sourceDateEpoch,
+  }),
   context: {
     nodeVersion: process.version,
     packageManager: String(packageJson.packageManager ?? ""),