Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/user/cli-reference.md`:
- Around line 2075-2094: Add blank lines around the fenced code blocks and the
Flags table to satisfy markdownlint MD031/MD058: ensure there's a blank line
before and after the initial ```shell block under "Synopsis" and similarly a
blank line before the "Flags:" table and one blank line after that table (before
"Exit codes"), and add a blank line before the final ```shell block under
"Examples"; update the fenced blocks to start with "```shell" and have an empty
line immediately after the opening fence and an empty line immediately before
the closing fence to keep spacing consistent.

In `@pkg/cli/evidence_digest.go`:
- Around line 71-100: runEvidenceDigestCmd mixes CLI orchestration with business
logic (hydrating recipe, canonicalizing YAML, computing digest); extract that
logic into a new function (e.g., ComputeRecipeDigest(ctx, path, kubeconfig,
version) placed in a functional package such as attestation or pkg/evidence)
that performs recipe.LoadFromFile, serializer.MarshalYAMLDeterministic and
attestation.SubjectDigest and returns the digest string or an error; then
simplify runEvidenceDigestCmd to only validate flags, call the new
ComputeRecipeDigest with cmd.String("kubeconfig") and path, and print the
returned digest, preserving existing error wrapping behavior.
- Line 82: The recipe loader currently calls serializer.FromFileWithKubeconfig
using context.Background(), which ignores the caller ctx passed into
recipe.LoadFromFile; change recipe.LoadFromFile (in pkg/recipe/loader.go) to
accept and forward the caller ctx into serializer functions, and inside the
serializer call sites replace context.Background() usages with derived contexts
created from the caller ctx using context.WithTimeout(ctx,
defaults.FileReadTimeout) (and defaults.ConfigMapWriteTimeout where applicable)
so caller cancellation/timeouts are honored; update the
serializer.FromFileWithKubeconfig (and related serializer methods) signatures to
accept a context parameter and propagate it through file/ConfigMap I/O calls.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/evidence/attestation/recipe_digest.go`:
- Around line 42-45: The marshal error is being unconditionally wrapped with
errors.ErrCodeInternal, which discards any existing structured code; replace the
current wrap in the block that calls serializer.MarshalYAMLDeterministic(rec) so
that you use errors.PropagateOrWrap(err, errors.ErrCodeInternal, "failed to
marshal recipe for digest") instead of errors.Wrap, preserving coded errors from
serializer.MarshalYAMLDeterministic while still providing the contextual message
(update the error return in the function containing recipeYAML and the
serializer call).