ci: add reproducible supply-chain gates

docs/SUPPLY_CHAIN_POLICY.md

@@ -0,0 +1,61 @@
+# Supply-chain policy
+
+The committed `uv.lock` is the reproducible dependency source for the supported
+Python 3.10–3.12 test matrix. CI installs CPU-only PyTorch from PyTorch's
+explicit package index and resolves every other package from PyPI. The lock
+contains exact versions, source URLs, environment markers, and artifact hashes.
+
+CI uses exact Python tool versions and checksum-pinned standalone binaries.
+`ci/digests.txt` records executable and GitHub Action pins; build, test, and
+license-tool transitive dependencies are covered by `uv.lock`.
+
+## Required evidence
+
+The Supply chain job retains these artifacts for 14 days:
+
+- one redacted Gitleaks JSON report for the checkout;
+- OSV audit JSON and scanner status for Python 3.10, 3.11, and 3.12 on Linux;
+- a JSON license inventory for all packaged extras;
+- a CycloneDX 1.5 SBOM bound to the built wheel by SHA-256;
+- the policy decisions and built wheel used by those checks.
+
+Every secret finding and every OSV vulnerability is blocking by default. OSV
+does not provide a normalized severity for every advisory, so the policy treats
+unknown, low, medium, high, and critical findings alike. This is stricter than
+a high-only threshold and avoids silently passing advisories with missing
+severity data.
+
+License metadata must exactly match an expression in
+`ci/supply-chain-policy.json`. OBLITERATUS itself is excluded from dependency
+license evaluation because its AGPL license is the project license rather than
+a third-party dependency decision.
+
+## Exceptions
+
+Exceptions live only in `ci/supply-chain-policy.json`; command-line ignores and
+unconditional success conversion are forbidden.
+
+- A vulnerability exception names an OSV/GHSA/CVE identifier, states a reason,
+  records `approved_on` and `expires`, and declares whether a fix is available.
+  Fixable findings may be excepted for at most 7 days; findings without a fix
+  may be excepted for at most 90 days.
+- A secret exception names the redacted Gitleaks fingerprint, states a reason,
+  and records `approved_on` and `expires`. It may last at most 30 days.
+- Expired, overlong, stale, malformed, or unused exceptions fail CI. A finding
+  that gains a fix cannot use an exception declared as unfixable.
+- License exceptions are not supported. Add an exact expression only after a
+  maintainer verifies the package metadata and compatibility with AGPL-3.0-or-later.
+
+## Updating the lock and tools
+
+Use the version of uv recorded in `ci/digests.txt`:
+
+```bash
+uvx --from uv==0.12.4 uv lock --upgrade
+uvx --from uv==0.12.4 uv lock --check
+```
+
+Review the complete lock diff, source indexes, new licenses, vulnerability
+evidence, and SBOM diff. Update direct pins in `pyproject.toml` and executable
+pins/checksums in `ci/digests.txt` in the same pull request. A normal dependency
+or tool update must not add an exception merely to make CI green.