fix: enforce exact local evidence defaults

scripts/generate-supply-chain.ts

@@ -25,7 +25,9 @@ import {
   verifySupplyChainCoherence,
 } from "./lib/supply-chain.ts";
 import {
+  createLocalVulnerabilityReport,
   distChecksumsText,
+  LOCAL_SUPPLY_CHAIN_UNVERIFIED_DEFAULTS,
   recomputeDependencyEvidence,
   recomputeLicenseEvidence,
 } from "./lib/local-policy-evidence.ts";
@@ -186,16 +188,9 @@ const licenseEvidence = recomputeLicenseEvidence({
   policy: licensePolicy,
 });
 
-const vulnerabilityReport = {
-  schemaVersion: 1,
-  provider: "UNCONFIGURED",
-  scannedLockfileSha256: inventory.lockfileSha256,
-  status: "FAIL_UNVERIFIED",
-  findings: [],
-  exceptionsApplied: [],
-  failures: ["external vulnerability provider report is missing"],
-  blocking: [],
-};
+const vulnerabilityReport = createLocalVulnerabilityReport(
+  inventory.lockfileSha256,
+);
 
 const sourceFiles = [...repositoryInventory.trackedFiles];
 const sourceSetSha256 = await digestReleaseInputFiles(sourceFiles);
@@ -301,15 +296,13 @@ const localPassed = localFailures.length === 0;
 const verification = {
   schemaVersion: 1,
   localStatus: localPassed ? "PASS" : "FAIL",
-  promotionStatus: "FAIL_UNVERIFIED",
+  ...LOCAL_SUPPLY_CHAIN_UNVERIFIED_DEFAULTS,
   lockfileSha256: inventory.lockfileSha256,
   sourceSetSha256,
   distSha256: distDigest,
   sbomSha256: supplyChainDigest(sbom),
   dependencyDiff: dependencyPolicy.dependencyDiff,
   highRiskReview: dependencyPolicy.highRisk,
-  vulnerabilityStatus: vulnerabilityReport.status,
-  provenanceAttestationStatus: "FAIL_UNVERIFIED",
   failures: localFailures,
 };
 const bundleReport = {