Acquisition provenance: attach OCI referrer with acquisition details on mirror

[toddysm]

Summary

When an image is acquired (mirrored) from an external registry into quarantine/<image>, attach a new OCI 1.1 referrer artifact to the mirrored image that records acquisition details — where the image came from and how it was acquired.

Motivation

Today the mirror flow copies the upstream image (and optionally its referrers) into ghcr.io/<owner>/quarantine/<image>, but it does not record any first-party provenance about the acquisition itself. Once an image sits in quarantine we lose the context of:

• the source registry / repository / tag it came from (e.g. docker.io/library/python:3.14-slim),
• the source digest at acquisition time,
• when it was acquired and by which workflow run,
• whether referrers were copied, force was used, etc.

This makes it hard to answer "where did this image come from, and when did we pull it?" from the artifact itself, in a portable, registry-native way.

Design

Settled and documented in docs/architecture/acquire/acquisition-provenance.md:

• Artifact: in-toto Statement (application/vnd.in-toto+json), predicate type https://toddysm.com/acquisition-provenance/v0.1.
• Subjects: both the tag/index and each per-platform child manifest.
• Scope: external → quarantine acquisition only (via _mirror-image.yml, never promotion).
• Trigger: only when mirror-image reports copied == true.
• Shape: new attach-acquisition-provenance composite action + record_acquisition_provenance input (default true) on _mirror-image.yml.

Work items

• Acquisition provenance: attach-acquisition-provenance composite action #141 — attach-acquisition-provenance composite action
• Acquisition provenance: wire into _mirror-image.yml #142 — Wire into _mirror-image.yml (depends on Acquisition provenance: attach-acquisition-provenance composite action #141)
• Acquisition provenance: documentation #143 — Documentation (depends on Acquisition provenance: wire into _mirror-image.yml #142)

[toddysm]

Completed. All work items done and merged in #144 (commit 858c5ea):

• Acquisition provenance: attach-acquisition-provenance composite action #141 — attach-acquisition-provenance composite action
• Acquisition provenance: wire into _mirror-image.yml #142 — wired into _mirror-image.yml (record_acquisition_provenance input, digest-change gated)
• Acquisition provenance: documentation #143 — documentation (design + reference + catalogue)

Copilot review addressed (5 comments, all resolved). Every image acquired external → quarantine now carries an OCI 1.1 acquisition-provenance in-toto referrer.