Add signal contracts for reachability, exploitability, trust, and unknown symbols

- Introduced `ReachabilityState`, `RuntimeHit`, `ExploitabilitySignal`, `ReachabilitySignal`, `SignalEnvelope`, `SignalType`, `TrustSignal`, and `UnknownSymbolSignal` records to define various signal types and their properties.
- Implemented JSON serialization attributes for proper data interchange.
- Created project files for the new signal contracts library and corresponding test projects.
- Added deterministic test fixtures for micro-interaction testing.
- Included cryptographic keys for secure operations with cosign.

tools/cosign/sign-signals.sh

@@ -32,12 +32,19 @@ elif [[ -n "${COSIGN_PRIVATE_KEY_B64:-}" ]]; then
   KEY_FILE="$TMP_KEY"
 elif [[ -f "$ROOT/tools/cosign/cosign.key" ]]; then
   KEY_FILE="$ROOT/tools/cosign/cosign.key"
+elif [[ "${COSIGN_ALLOW_DEV_KEY:-0}" == "1" && -f "$ROOT/tools/cosign/cosign.dev.key" ]]; then
+  echo "[warn] Using development key (tools/cosign/cosign.dev.key); NOT for production/Evidence Locker" >&2
+  KEY_FILE="$ROOT/tools/cosign/cosign.dev.key"
 else
   echo "No signing key: set COSIGN_PRIVATE_KEY_B64 or COSIGN_KEY_FILE, or place key at tools/cosign/cosign.key" >&2
   exit 2
 fi
 
 OUT_BASE="${OUT_DIR:-$ROOT/evidence-locker/signals/2025-12-01}"
+# Normalize OUT_BASE to absolute to avoid pushd-relative path issues.
+if [[ "$OUT_BASE" != /* ]]; then
+  OUT_BASE="$ROOT/$OUT_BASE"
+fi
 mkdir -p "$OUT_BASE"
 
 ARTIFACTS=(
@@ -46,9 +53,12 @@ ARTIFACTS=(
   "heuristics/heuristics.catalog.json|stella.ops/heuristicCatalog@v1|heuristics_catalog"
 )
 
-COSIGN_VERSION="$($COSIGN_BIN version | head -n1)"
 USE_BUNDLE=0
-[[ "$COSIGN_VERSION" == *"v3."* ]] && USE_BUNDLE=1
+if $COSIGN_BIN version --json 2>/dev/null | grep -q '"GitVersion":"v3'; then
+  USE_BUNDLE=1
+elif $COSIGN_BIN version 2>/dev/null | grep -q 'GitVersion:.*v3\.'; then
+  USE_BUNDLE=1
+fi
 
 pushd "$ROOT/docs/modules/signals" >/dev/null
 
@@ -67,7 +77,8 @@ for entry in "${ARTIFACTS[@]}"; do
     COSIGN_PASSWORD="${COSIGN_PASSWORD:-}" \
     "$COSIGN_BIN" sign-blob \
       --key "$KEY_FILE" \
-      --predicate-type "$predicate" \
+      --yes \
+      --tlog-upload=false \
       --bundle "$bundle" \
       "$path"
     printf "%s  %s\n" "$(sha256sum "$bundle" | cut -d' ' -f1)" "$(realpath --relative-to="$OUT_BASE" "$bundle")" >> "$SHA_FILE"
@@ -76,7 +87,8 @@ for entry in "${ARTIFACTS[@]}"; do
     COSIGN_PASSWORD="${COSIGN_PASSWORD:-}" \
     "$COSIGN_BIN" sign-blob \
       --key "$KEY_FILE" \
-      --predicate-type "$predicate" \
+      --yes \
+      --tlog-upload=false \
       --output-signature "$sig" \
       "$path"
     printf "%s  %s\n" "$(sha256sum "$sig" | cut -d' ' -f1)" "$(realpath --relative-to="$OUT_BASE" "$sig")" >> "$SHA_FILE"