Summary

Follow-up to #1499 (aicr.run domain migration). Fixes two defects that PR's domain sweep introduced: ValidatorCatalog doc examples pointed at an invalid apiVersion, and two committed demo evidence pointers became unverifiable.

Motivation / Context

#1499 mechanically swept aicr.nvidia.com → aicr.run. A cross-review surfaced that the sweep touched two surfaces it shouldn't have:

F3 — ValidatorCatalog examples (invalid apiVersion). The validator catalog is a separate schema and is explicitly NOT part of the artifact-domain migration. Its loader fail-closes on anything other than validator.nvidia.com/v1alpha1 (pkg/validator/v1/catalog.go CatalogAPIVersion; rejected in pkg/validator/catalog/catalog.go). #1499 swept four example blocks aicr.nvidia.com/v1 → aicr.run/v1 — still invalid — so an integrator copying any of them hits unsupported apiVersion "aicr.run/v1" at load. Fixed all four to validator.nvidia.com/v1alpha1:

• docs/integrator/validator-extension.md:52, :150
• recipes/validators/README.md:8
• docs/design/002-validatorv2-adr.md:70

Also aligned the three ValidatorCatalog test fixtures in pkg/recipe/provider_test.go to validator.nvidia.com/v1alpha1 (they passed before only because the layered provider merges external catalogs under the embedded header; this keeps test data honest).

F2 — unverifiable demo evidence pointers. #1499 edited predicateType in place to https://aicr.run/recipe-evidence/v1 in the two committed demo pointers, but bundle.digest/oci still pin the pre-migration, immutable OCI artifacts whose signed in-toto statements carry the old predicate type. aicr evidence verify materializes the bundle, then fails with unexpected predicateType https://aicr.nvidia.com/recipe-evidence/v1 (pkg/evidence/verifier/verify.go / signature.go compare the fetched statement, not the YAML). A YAML-only fix is impossible in both directions: legacy fails LoadAndValidatePointer (pointer.go), and aicr.run fails the pulled-bundle check. The only true fix — regenerate + re-sign + republish the bundles — needs signing keys and OCI push, so this PR instead removes the two stale pointers (they also pinned a personal fork org, ghcr.io/yuanchen8911/aicr-evidence, not a canonical NVIDIA source) and the now-orphaned community allowlist anchor that existed solely to back them.

Two user docs (docs/user/cli-reference.md, docs/user/artifact-verification.md) showed the now-deleted concrete pointer path as the preferred aicr evidence verify example; switched both to the generic recipes/evidence/<recipe>/<src>/<digest>.yaml form.

Regenerating proper signed demo evidence under the NVIDIA org is a separate follow-up (it is the only path that restores verifiable evidence; editing strings cannot).

Fixes: N/A (follow-up to #1499)
Related: #1499

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• Documentation update

Component(s) Affected

• Validator (pkg/validator)
• Docs/examples (docs/, examples/)
• Other: pkg/evidence/allowlist, recipes/evidence/

Implementation Notes

• The two evidence pointers were the only ones anchored by the community source slug 7c4c0edc…, so the community allowlist entry is removed too (→ community: []); the blocking evidence-pointer-contract gate enforces pointer→allowlist (not the reverse), so an empty community list with no community pointers is consistent.
• pkg/evidence/allowlist/allowlist_test.go TestClassify loads the real committed allowlist.yaml; its "community by slug" case is updated to assert that a community-issuer signer is now admitted as "reported" only (no community entries). This is a fixture update to match the intentional allowlist change, not a disabled test.
• Verified outside the repo while reviewing: https://get.aicr.run resolves and serves the install script (HTTP 200). The https://aicr.run/... predicate/buildType URIs are in-toto/SLSA type identifiers (compared as strings, never dereferenced), so the apex not resolving is expected and not a defect.

Testing

go test ./pkg/evidence/allowlist/... ./pkg/evidence/verifier/... ./pkg/validator/catalog/... ./tools/evidence-project/...   # ok
golangci-lint run -c .golangci.yaml ./pkg/evidence/allowlist/...                                                          # 0 issues

Scope is docs + sample-evidence removal + one test fixture; no production Go logic changed. Targeted package tests and lint pass locally; full make qualify (e2e/scan/cluster) runs in CI.

Risk Assessment

• Low — Doc corrections plus removal of unverifiable sample evidence; no production code paths affected. Easy to revert.

Rollout notes: Demo evidence for h100-gke-cos-training / gb200-eks-ubuntu-training is removed until regenerated under the NVIDIA org (tracked follow-up). No runtime/API impact.

Checklist

• Tests pass locally (targeted packages with -race-equivalent unit runs)
• Linter passes (golangci-lint on the changed package: 0 issues)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality
• I updated docs if user-facing behavior changed
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)