build: package CLI with pinned producer verifier

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 09:20:33 +02:00
parent c80a944105
commit ebca4f5adb
9 changed files with 433 additions and 1 deletions

View file

@ -86,3 +86,5 @@ speaks in lanes and guarded plans.
not write.
- Temporary bootstrap OpenBao credentials must live outside repos, use mode
0600, be revocable, and be removed after narrower auth is working.
Packaged CLI deployment uses the reviewed [wheel + verifier bundle](docs/cli-release-bundle.md). A Python wheel alone omits the mandatory signature helper.