Attest reproducible Python distributions

[omar07ibrahim]

Summary

• build twice from exactly 15 stage-zero Git inputs with a pinned backend, then validate bounded wheel and sdist inventories plus canonical metadata
• rebuild the wheel from the canonical sdist and run an offline target-install smoke test without ever sampling a password
• publish a canonical member-level attestation, a real terminal capture, and a measured build/rebuild architecture diagram
• enforce honest negative boundaries for licensing, signatures, dependency integrity, cross-platform reproducibility, and arbitrary archives
• make the existing browser evidence reproducible by settling layout, preserving the declared viewport, and pinning Chromium to one raster thread

Verification

• make PYTHON=.venv/bin/python check
• 264 tests passed with 100% line and branch coverage
• Ruff, formatting, strict mypy, dependency integrity, distribution attestation, and evidence validation passed
• two consecutive full evidence rebuilds produced identical hashes for all 18 artifacts and an empty worktree diff
• a fresh attester report is byte-identical to the checked-in canonical JSON

Evidence

• Distribution contract diagram
• Real attestation terminal capture
• Canonical attestation JSON
• Reproducibility manifest