security(attestation): cross-bind receipt manifest claims to exact predicate semantics #2311

Finding

#2309 makes the unsigned completion manifest self-describing and binds it to the exact predicate bytes with predicate_sha256. The manifest also duplicates policy-relevant fields from those predicate bytes (source_repository, source_sha, workflow_run_id, predicate type, artifact metadata, evidence SHA, ordered execution-artifact identities), but validate_receipt_manifest() currently validates those manifest fields only for syntax. It does not prove that the duplicated values equal the values inside the predicate whose SHA it verifies.

An unsigned manifest can therefore be altered to another syntactically valid repository/run/artifact/execution identity while retaining the correct predicate_sha256. A future signer that consults the manifest for policy and signs the predicate bytes can observe two contradictory representations of the same receipt pair.

This is an owner-contract ambiguity. It does not authorize TEPP psychometric decisions in .github and does not make the unsigned pair authenticated provenance.

Acceptance

• Strictly parse the exact predicate bytes before accepting the completion marker.
• Fail closed on predicate schema/type drift relevant to the signer handoff.
• Cross-bind every manifest field that duplicates predicate/evidence content to the exact value represented by the predicate bytes: source repository/SHA/run, predicate type, artifact digest/id/name, evidence filename/SHA, and ordered execution-artifact identities.
• Preserve predicate_sha256 recomputation as the primary byte-identity check.
• Keep attestation_claim = origin_and_integrity_only and the current explicit does_not_prove boundary; no RMSE/bias/construct/estimator authority in .github.
• Add hostile RED for a syntactically valid but semantically contradictory manifest and 100% owned branch/docstring coverage.

Refs #2299 #2300 #2307 #2309 ContextualWisdomLab/TEPP#637.