feat: enforce live supply chain provenance gates

packages/casan-harness/scripts/bash/verify-signed-commits.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Verify every commit in a release range has a cryptographically good Git
+# signature. This is deliberately strict for release/main enforcement: unsigned
+# or merely unknown signatures cannot become production provenance.
+# Usage: verify-signed-commits.sh [range]  (default: HEAD)
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/casan-paths.sh"
+ROOT="$CASAN_APP_ROOT"; RANGE="${1:-HEAD}"
+commits=()
+while IFS= read -r commit; do [[ -n "$commit" ]] && commits+=("$commit"); done < <(git -C "$ROOT" rev-list --reverse "$RANGE")
+[[ "${#commits[@]}" -gt 0 ]] || { echo "SIGNED_COMMITS_FAIL empty_range=$RANGE" >&2; exit 1; }
+for commit in "${commits[@]}"; do
+  status="$(git -C "$ROOT" log -1 --format='%G?' "$commit")"
+  [[ "$status" == G ]] || { echo "SIGNED_COMMITS_FAIL commit=$commit signature_status=$status" >&2; exit 1; }
+done
+echo "SIGNED_COMMITS_VERIFIED range=$RANGE count=${#commits[@]}"