Operate scheduled chain-head attestation (AUDIT-WP-0009-T12)

Apply the separate attestor identity, named-ConfigMap RBAC, attest
egress and daily CronJob. Bootstrap an empty chain-head ConfigMap
only because it was absent; drop the placeholder from the apply path
so a later apply cannot overwrite a live head. One-shot job published
a 59-event attestation; mounted readback and receiver write-denial
passed. Offsite copy stays the operator path.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082

tests/test_layer_conformance.py

@@ -97,3 +97,6 @@ def test_the_receiver_has_no_api_server_egress():
     attest = next(d for d in documents if "name: audit-core-attest-egress" in d)
     assert "component: attest" in attest
     assert "6443" in attest
+    assert "443" in attest
+    assert "6443" not in receiver
+    assert "443" not in receiver