Document SLSA provenance fields in the transparency manifest reference

[gkanitz]

Context

Update the user-facing documentation for the transparency manifest to describe the new slsa_provenance block: what each field means, when it is present, and how it relates to SLSA v1.2 so report readers understand the informational-only framing.

Acceptance criteria

• The existing transparency manifest reference document (location confirmed by developer agent from the repo) gains a new section titled ## slsa_provenance (or equivalent heading matching the doc's style).
• The section states explicitly: "These fields are informational-only. They mirror data already present in the verification block, expressed using SLSA v1.2 provenance predicate field names. They are not a conformance claim and do not constitute a signed SLSA provenance statement."
• Each field (build_type, builder_id, invocation_id, started_on, finished_on, resolved_dependencies) has:
  • a one-sentence description of what it contains.
  • a note on where the value comes from (e.g. "sourced from verification.workflow_ref").
  • a literal example value matching the examples used in slices 2 and 3.
• The section states that slsa_provenance is null or absent when the report was not produced in a GitHub Actions CI environment.
• A link to the SLSA v1.2 provenance predicate specification is included (URL to be confirmed by developer agent from https://slsa.dev at time of writing).
• The PR for this slice is marked ready for merge only after a human reviewer confirms the informational-only framing is accurately stated.

Scope / files

• The existing transparency manifest reference doc (markdown file, path confirmed by developer agent).
• docs/slsa-field-mapping.md may be cross-referenced but is not deleted.

Out of scope

• Changes to Go source or test files.
• Any claim of SLSA conformance or level compliance.

Gates

go test ./..., go vet ./..., gofmt -l . (safety check; no Go changes expected)

Blocked by: #108