fix: review and harden CI/CD evidence pipeline code

[RickCogley]

Summary

The CI/CD evidence pipeline code in docs/sbom/ was developed in a separate chat without full repo context. A code review identified critical bugs, security issues, and integration gaps that need fixing before deployment.

Changes

Critical fixes

• oidc.ts: JWT header/payload decoded with atob() instead of base64url — causes intermittent auth failures
• ci-security-v1.rego: Missing secrets scan data silently passes (should block, matching sarif_critical behavior)
• attest-and-ship.yml: OPA binary downloaded without SHA-256 integrity check

High fixes

• package.json + tsconfig.json + wrangler.jsonc: Source paths reference src/ but files are at package root — code won't compile
• index.ts: policy_version and decision always stored as empty strings in D1 — key audit columns unusable
• attest-and-ship.yml: CWE-78 injection — ${{ }} interpolation in run: steps moved to env: blocks (Semgrep finding)

Medium fixes

• wrangler.jsonc: Incomplete observability config; placeholder account_id
• oidc.ts: Missing nbf (not-before) claim validation
• attest-and-ship.yml: Fragile SARIF aggregation pipeline replaced with robust per-file loop

Integration alignment

• Updated runbook to reference existing security.yml (not nonexistent lint-and-scan.yml)
• Documented Trivy/Grype overlap (don't add Grype)
• Documented collect-scan-results bridge job needed in security.yml

Acceptance criteria

• All files in docs/sbom/ pass Semgrep scan
• Configs are internally consistent (paths match file layout)
• Runbook references match actual workflow names

InfoSec: fixes JWT verification bug, OPA supply chain integrity, GH Actions injection (CWE-78), and policy logic gap