ci: bind release evidence to artifact hashes

docs/SUPPLY_CHAIN_POLICY.md

@@ -9,6 +9,36 @@ CI uses exact Python tool versions and checksum-pinned standalone binaries.
 `ci/digests.txt` records executable and GitHub Action pins; build, test, and
 license-tool transitive dependencies are covered by `uv.lock`.
 
+## Digest-bound release evidence
+
+Release artifacts use a build-once evidence chain. The release package job is
+the sole producer of the wheel and source distribution. It also emits a bound
+CycloneDX SBOM and a canonical `SHA256SUMS` manifest covering both distributions
+and the SBOM.
+
+GitHub's keyless Sigstore-backed attestation service signs two in-toto
+statements for that release set:
+
+- SLSA build provenance for every subject named by `SHA256SUMS`;
+- an SBOM attestation binding the CycloneDX document to the wheel digest.
+
+The supply-chain job downloads the package job's retained artifact, verifies
+`SHA256SUMS`, and revalidates the SBOM binding. It must not rebuild a substitute
+wheel. Publication must use these same tested and attested bytes. A commit,
+dependency lock, build instruction, artifact, checksum manifest, SBOM, or
+release-policy change invalidates the evidence.
+
+Consumers can perform the portable integrity check with:
+
+```bash
+sha256sum --check SHA256SUMS
+```
+
+For authenticity and provenance, verify each distribution against the canonical
+repository with GitHub's attestation verifier. A checksum without its signed
+provenance proves byte integrity only; it does not prove who built the artifact
+or which source and build instructions produced it.
+
 ## Required evidence
 
 The Supply chain job retains these artifacts for 14 days: