Document SLSA provenance fields in the transparency manifest reference (#109)

[gkanitz]

Closes #109

🤖 Autonomous loop in progress - DA/QAA rounds are posted as comments below.

[gkanitz]

Round 1 — APPROVED

Gate results

Gate	Status	Exit code
test	PASS	0
vet	PASS	0
fmt	PASS	0

Gate output

test (exit 0 - PASS)

Full gate output

vet (exit 0 - PASS)

(clean pass - no output)

fmt (exit 0 - PASS)

(clean pass - no output)

QAA rationale

Approval Rationale

Acceptance Criteria - All Met

1. New section ## slsa_provenance added to docs/verification.md (line 220)

2. Informational-only framing explicitly stated (lines 227-230):
   "These fields are informational-only. They mirror data already present in the verification block, expressed using SLSA v1.2 provenance predicate field names. They are not a conformance claim and do not constitute a signed SLSA provenance statement."

3. All six fields fully documented with required elements:

   • build_type: Description, sourced from constant, example URI
   • builder_id: Description, sourced from GITHUB_SERVER_URL and GITHUB_WORKFLOW_REF, example workflow URI with refs/heads branch
   • invocation_id: Description, sourced from multiple env vars, mirrors verification.run_url, example run URL
   • started_on: Description, sourced from build start time, RFC 3339 example
   • finished_on: Description, sourced from build completion time, mirrors report.generated_at, RFC 3339 example
   • resolved_dependencies: Description, sourced with CodeRepute version, array-of-objects example with uri field

4. Null/absent behavior documented (lines 232-234): Block is null when not in GitHub Actions environment, populated only when GITHUB_ACTIONS=true

5. Link to SLSA v1.2 provenance predicate specification included (line 224)

Gate Results

• go test ./...: PASS
• go vet ./...: PASS
• gofmt -l .: PASS

Documentation Quality

• No scope creep (documentation-only change)
• Clear markdown structure using definition list format for field documentation
• Cross-references to verification block fields where appropriate (workflow_ref, run_url, generated_at)
• Examples are internally consistent with field descriptions
• Environment variable sourcing clearly tied to actual GitHub Actions variables (GITHUB_ACTIONS, GITHUB_SERVER_URL, GITHUB_WORKFLOW_REF, GITHUB_REPOSITORY, GITHUB_RUN_ID)

Note for Human Reviewer: The issue requires human confirmation that the informational-only framing is accurately stated. The documentation clearly establishes that these fields are mirror/reference values only, not a SLSA conformance claim, which meets this requirement.