Operate scheduled chain-head attestation (AUDIT-WP-0009-T12)

Apply the separate attestor identity, named-ConfigMap RBAC, attest
egress and daily CronJob. Bootstrap an empty chain-head ConfigMap
only because it was absent; drop the placeholder from the apply path
so a later apply cannot overwrite a live head. One-shot job published
a 59-event attestation; mounted readback and receiver write-denial
passed. Offsite copy stays the operator path.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082

docs/evidence/2026-09-15-t12-attest-run.json

@@ -0,0 +1,23 @@
+{
+  "task": "AUDIT-WP-0009-T12",
+  "observed_at": "2026-09-15T19:15:40+00:00",
+  "job": "audit-core-attest-t12",
+  "job_succeeded": true,
+  "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615",
+  "published": true,
+  "schema": "audit-core.chain-head.v1",
+  "event_count": 59,
+  "head_prefix": "bb0937f02a772d1c",
+  "mounted_readback": true,
+  "receiver_patch": "URLError",
+  "rbac": {
+    "default_sa_can_patch_chain_head": false,
+    "attest_sa_can_patch_chain_head": true,
+    "attest_sa_can_create_configmaps": false
+  },
+  "cronjob": "audit-core-attest-chain",
+  "schedule": "17 3 * * *",
+  "offsite_copy": "not_written_here",
+  "readyz_tamper_evidence": false,
+  "readyz_note": "live image reports last-known claim on /readyz; the mounted file is the live attestation. Offsite copy remains RESOURCE-WP-0002-T06."
+}