Follow-up from the review of #1357 (end-user artifact verification guide), merged as-is with this nit deferred.

Location: docs/user/artifact-verification.md, the "JSON Output for CI" section.

Problem: the example

case "$(aicr evidence verify recipes/evidence/<recipe>.yaml --format json | jq '.exit')" in
  ...
esac

is fragile under set -o pipefail (common in CI): when aicr evidence verify exits non-zero (exit 2 = bundle invalid), the pipeline status propagates into the command substitution and can abort the script before the case runs. It fails closed (no false-pass), but it does not behave as the guide implies.

Fix (from @mchmarny's review comment): write to a file first and absorb the exit.

aicr evidence verify recipes/evidence/<recipe>.yaml --format json -o result.json || true
case "$(jq '.exit' result.json)" in
  0) echo "evidence valid" ;;
  1) echo "validator phases failed" ;;
  2) echo "bundle invalid" ;;
esac

Optional while in there: normalize the evidence-verify JSON flags (the guide uses both --format json and -t json/-o).

Flagged by @mchmarny in review; deferred to keep the first-time contributor's PR moving.