fix: add git+environment attestors to trace job for proper subjects

fix: wrap trivy CLI directly with cilock run instead of cilock-action

fix: pre-install trivy and pass skip-setup-trivy=true

fix: use trivy-action@v0.35.0 (v-prefixed tag, latest clean release)

feat: wrap real aquasecurity/trivy-action with cilock-action

fix: pass subject digest to cilock verify for source-restriction policy

feat: add source-restriction OPA policy for github-action attestor

feat: add perf benchmark jobs comparing npm install with and without trace

fix: add functionaries to trace behavioral policy for Fulcio cert matching

test: upgrade to cilock v0.0.4-fix for subjectless collection + attestation-on-failure fixes

fix: simplify trace policy to single step to isolate verification issue

fix: use cilock sign to sign trace behavioral policy in CI

fix: re-sign trace behavioral policy with correct DSSE PAE format

feat: add trace-based behavioral OPA policy to detect covert credential harvesting

feat: add covert attack test with --trace to test ptrace file detection