Tessera v0.3.0 — signed conformance gate (early)

Tessera is a domain-agnostic, signed conformance gate — checklist-as-code for
cross-cutting compliance. Concept & design by Tony Maida. Apache-2.0.

This is an early release of a working tool (not "the answer to MOSA" — see
docs/VIABILITY.md for the candid scope).

What works

• Engine (tessera check / tessera verify), embedding OPA — one static binary, air-gap friendly.
• Manifest schema validation — malformed manifests are rejected with precise JSON-pointer errors.
• Signed receipts + independent verification — Ed25519 signature, digest, key pinning (--key), chain linkage (--prev). Tampering breaks verification.
• Signed, expiring, attributed waivers (--waivers) — honors MOSA's "to the maximum extent practicable" without hiding findings.
• SARIF output (--sarif) — findings integrate with GitHub code scanning / IDEs.
• Packs (content, not platform): packs/mosa (flagship) + packs/cyber-rmf (multi-domain demonstration).
• SysML v2 adapter — derive a manifest from a model (attestation → verification), incl. modules, interfaces, objectives, requirements.
• CI gates both examples, runs the adapter, the end-to-end derive→gate pipe, signs+verifies a receipt, exercises the waiver flow, and rejects tampered receipts + malformed manifests.

Deferred (named honestly in VIABILITY.md)

Cost/risk derivation, UAF/SysML 1.x XMI + Capella adapters, dashboards, and an optional cost-benefit module.