Roadmap: upstream an official in-toto eval predicate (replace vendored predicate type)

[b7n0de]

Stated honestly on the deep-dive page as deferred / not yet built: proofbundle emits DSSE envelopes with a self-defined predicate type. The right end state is an official in-toto attestation predicate for eval results (discussion opened as in-toto/attestation#565).

Scope:

• drive the in-toto discussion to a predicate draft
• switch intoto.py to the official type once merged upstream
• conformance fixtures against the upstream schema

Part of the public roadmap (JOSS track, issue #24).

[b7n0de]

ADR added: decision-receipt as a separate vendored predicate. Following the 2026-07-09 discussion in in-toto/attestation#565, the maintainer decision is now recorded in docs/adr/0001-decision-receipt-separate-predicate.md.

Short form: eval-result stays pure metric evidence (Non-goals now explicit in the #565 proposal). Agent decisions are modeled as a separate vendored predicate proofbundle/predicates/decision-receipt/v0.1 (no claim on the in-toto.io namespace), coupled only through digest-bound evidenceRefs from decision to eval-result, never the reverse. Target release 2.1.0 on the Phase B trust-policy foundation. This issue stays the upstream-standardization tracker; the vendored predicate does not presuppose an upstream outcome.