fix: close immutable promotion trust gaps

scripts/lib/supply-chain-time.ts

@@ -0,0 +1,24 @@
+export function deterministicSupplyChainGeneratedAt(input: Readonly<{
+  generatedAt: string;
+  sourceDateEpoch: string | null;
+}>): string {
+  const generatedAtMs = Date.parse(input.generatedAt);
+  if (!Number.isFinite(generatedAtMs)) {
+    throw new TypeError("build manifest generatedAt must be an ISO timestamp");
+  }
+  if (input.sourceDateEpoch !== null) {
+    if (!/^(?:0|[1-9]\d*)$/u.test(input.sourceDateEpoch)) {
+      throw new TypeError("SOURCE_DATE_EPOCH must be whole seconds");
+    }
+    const epoch = Number(input.sourceDateEpoch);
+    if (
+      !Number.isSafeInteger(epoch) ||
+      new Date(epoch * 1000).toISOString() !== input.generatedAt
+    ) {
+      throw new TypeError(
+        "build manifest generatedAt must match SOURCE_DATE_EPOCH",
+      );
+    }
+  }
+  return new Date(generatedAtMs).toISOString();
+}