feat: add SLSA-aware policy engine for supply chain verification

[avrabe]

Summary

Adds a TOML-based policy engine for enforcing SLSA levels and supply chain security requirements on WebAssembly transformation chains.

Policy Engine (src/lib/src/policy/)

• SLSA level detection (L0-L4) based on attestation properties:
  • L1: Provenance exists (attestation present)
  • L2: Signed provenance (attestation signed)
  • L3: Hardened build (transparency log)
  • L4: Hermetic build (all inputs verified)
• Per-rule enforcement modes - strict (fail) vs report (warn only)
• Trusted tools with version constraints and public keys
• Trusted builders for CI/CD provenance validation
• Attestation age validation

CLI Changes

• --policy <FILE> flag for TOML policy files
• --strict override all rules to strict enforcement
• --report-only override all rules to report-only mode
• Pretty-print policy evaluation with SLSA improvement suggestions

Attestation Updates

• New fields: public_key, certificate_chain, rekor_uuid
• signing feature with build_and_sign_ed25519()
• standards feature re-exporting in_toto_attestation

Examples

• examples/policies/development.toml - permissive for local dev
• examples/policies/production.toml - strict SLSA L2 policy
• examples/policies/slsa-l3.toml - keyless with transparency log
• examples/loom-integration.md - full Loom integration guide

Usage

# Verify against policy
wsc verify-chain -i app.wasm --policy production.toml

# Override to report-only during rollout
wsc verify-chain -i app.wasm --policy production.toml --report-only

Test plan

• All 511 existing tests pass
• 40 new policy engine tests
• End-to-end flow tested with test script
• CI passes