security(supply-chain): require cosign verification on every devantler-tech OCIRepository, discovered by kind and URL

[devantler]

🤖 Generated by the Agentic Engineer

Part of #3308.

Evidence

Both cosign-subject guards (guard-shared-publish-workflow-pin.sh, and the approved-revision set guard from #3551) discover consumers by the subject text: a file is examined only if it carries a shared-publish-workflow subject. Measured while self-reviewing #3557: a second OCIRepository for the same artifact URL (oci://ghcr.io/devantler-tech/github-config/manifests) with no spec.verify at all is invisible to both guards, and no other control requires verify on an OCIRepository — validate-flux-verify covers the root source only, and the Kyverno cluster policies do not touch OCIRepositories.

Audience / impact

An unverified OCIRepository pointed at a consumer's artifact bypasses everything the two matcher guards protect: Flux would apply an unsigned or foreign-signed artifact with every check green. It is the cheapest bypass of the supply-chain floor, and the one shape neither guard was written to see.

Expected

A CI check discovers OCIRepositories by kind and URL (not by subject text) and requires every oci://ghcr.io/devantler-tech/* OCIRepository to carry spec.verify with provider: cosign and exactly one matchOIDCIdentity entry. The root source's first-party identity stays admitted by its own documented rule.

Acceptance criteria

• An OCIRepository for a devantler-tech GHCR artifact with no spec.verify fails CI (RED case committed).
• An OCIRepository with verify but zero identity entries fails CI.
• The real tree passes, with the root source's branch identity covered by name.

Rough size: S.