feat: produce governed contribution attestations

[adrianwebb]

Outcome

Adds the Agent runtime operation that requests, validates, and renders an exact-head project contribution attestation without giving the guest agent GitHub credentials or human legal authority.

Work authority

• Work item / Issue: Platform ledger CONTRIBUTION-AUTH-001
• Proposal / decision: user-approved project-scoped standing authorization architecture
• Actor: Codex primary implementation agent
• Human authority: @havensadrian
• Exact base ref: staging cd0d43e
• Exact head ref: codex/project-contribution-authorization f5c7a23

Contributor mode:

• Agent-assisted under human authority

Plan

1. Require the definition opt-in and contribution_attestation capability.
2. Request an exact assignment receipt from the trusted API.
3. Validate scope and Ed25519 signature locally.
4. Return only a managed PR-body block; keep GitHub mutation at the trusted provider/API boundary.

Verification

• Architecture correction: moved the test under tests/unit/agents/contributions/; architecture policy and 2 focused tests pass.

• Signed bundle and missing-capability unit cases: 2 tests passed.

• npm run build:dist — passed.

• git diff --check — passed.

• Exact-head push/PR Verify and Content passed against SDK head 5db07e79bbd32bcd753d7600d15b7412357fc8c5.

Risk and rollback

The Agent cannot create, broaden, renew, or revoke a grant; check the human box; or mutate GitHub directly. Revert with the companion SDK/API/CLI changes before activation.

Submission checklist

• Change is bounded to CONTRIBUTION-AUTH-001.
• Exact base/head refs are recorded.
• Hosted and cross-package acceptance is complete.
• No plaintext secrets or provider credentials are included.