#7)

Root cause of the persistent "Repository has changed during renovation"
aborts since PR #4 — Renovate was calling POST /repos/{owner}/{repo}/
statuses/{sha} after each branch creation to write a stability status
check (tied to the cooldown / merge-confidence flow). The workflow's
permissions block had contents:write, pull-requests:write, issues:write
but not statuses:write, so the call 403'd with "integration-
unauthorized". Renovate's error handler maps that internally to
"repository-changed", which is why every prior debugging attempt
(checkout, configurationFile, dry-run env, digest pin) chased the
wrong symptom.

Confirmed via debug log on run 25346172853:
  Request failed with status code 403 (Forbidden):
  POST .../statuses/cf3dc7d1...
  "x-accepted-github-permissions": "statuses=write"
  DEBUG: Caught error setting branch status - aborting
  Error: integration-unauthorized
  DEBUG: Passing repository-changed error up

The earlier hypothesis fixes in PRs #5 and #6 weren't wrong per se
(actions/checkout and configurationFile aren't the cause, and
RENOVATE_DRY_RUN='' isn't either) — they just couldn't have fixed the
underlying permission gap. With statuses:write added, Renovate's
post-branch status-check call should succeed and the run should
complete normally.

Audit findings #2, #3, #4 against generated evidence bundles:
predicate.validatorImages was always null, predicate.validatorCatalogVersion
was always empty, and the pointer's signer block emitted zero-valued
identity/issuer + rekorLogIndex:0 for unsigned bundles — making a real
Rekor log index 0 indistinguishable from 'no Rekor entry' and an
unsigned bundle indistinguishable from one whose signer fields failed
to extract.

Changes:

  - emitRecipeEvidence loads the validator catalog once and feeds it
    to both the BOM (chart refs + validator images) and the
    predicate's ValidatorCatalogVersion + ValidatorImages fields.
    Shared dedupValidatorImages helper collapses the catalog's
    one-entry-per-check duplication (deployment/perf/conformance all
    share images).

  - PointerAttestation.Signer becomes *PointerSigner, omitempty.
    Unsigned bundles emit the attestation entry with no signer block
    at all; signed bundles always carry non-nil Signer with populated
    Identity and Issuer.

  - PointerSigner.RekorLogIndex becomes *int64, omitempty. nil = no
    Rekor entry created (--no-rekor signing path); non-nil = real
    Rekor log index, even when zero (Rekor's first-ever entry occupies
    index 0 and that's a legitimate position a consumer should be
    able to verify).

  - signAndPushBundle's no-push path returns signPushOutcome{} rather
    than signPushOutcome{Sign: &SignResult{}}, matching its existing
    'All fields are nil when --push is absent' comment and letting
    buildPointerInputs do the right nil-check.

Test coverage:

  - pkg/evidence/attestation/pointer_test.go: unsigned bundles MUST
    omit the signer YAML block; signed-without-rekor bundles MUST
    omit rekorLogIndex. Both assertions check rendered YAML, not just
    the struct.

  - pkg/cli/validate_evidence_test.go (new): catalogVersion,
    dedupValidatorImages, validatorImagesForPredicate helpers; and
    buildPointerInputs covers the three outcome shapes (unsigned,
    signed-with-rekor, signed-without-rekor).

Notes:

  - ValidatorImages.Digest remains blank in this PR. The catalog
    records image refs by tag, not by digest; resolving each ref to a
    digest needs a registry round-trip per image, which validate's
    hot path avoids. Audit item #10 (BOM image digests) tracks the
    longer-term resolver path; the same resolver will populate this
    field when it lands.

Audit findings #2, #3, #4 against generated evidence bundles:
predicate.validatorImages was always null, predicate.validatorCatalogVersion
was always empty, and the pointer's signer block emitted zero-valued
identity/issuer + rekorLogIndex:0 for unsigned bundles — making a real
Rekor log index 0 indistinguishable from 'no Rekor entry' and an
unsigned bundle indistinguishable from one whose signer fields failed
to extract.

Changes:

  - emitRecipeEvidence loads the validator catalog once and feeds it
    to both the BOM (chart refs + validator images) and the
    predicate's ValidatorCatalogVersion + ValidatorImages fields.
    Shared dedupValidatorImages helper collapses the catalog's
    one-entry-per-check duplication (deployment/perf/conformance all
    share images).

  - PointerAttestation.Signer becomes *PointerSigner, omitempty.
    Unsigned bundles emit the attestation entry with no signer block
    at all; signed bundles always carry non-nil Signer with populated
    Identity and Issuer.

  - PointerSigner.RekorLogIndex becomes *int64, omitempty. nil = no
    Rekor entry created (--no-rekor signing path); non-nil = real
    Rekor log index, even when zero (Rekor's first-ever entry occupies
    index 0 and that's a legitimate position a consumer should be
    able to verify).

  - signAndPushBundle's no-push path returns signPushOutcome{} rather
    than signPushOutcome{Sign: &SignResult{}}, matching its existing
    'All fields are nil when --push is absent' comment and letting
    buildPointerInputs do the right nil-check.

Test coverage:

  - pkg/evidence/attestation/pointer_test.go: unsigned bundles MUST
    omit the signer YAML block; signed-without-rekor bundles MUST
    omit rekorLogIndex. Both assertions check rendered YAML, not just
    the struct.

  - pkg/cli/validate_evidence_test.go (new): catalogVersion,
    dedupValidatorImages, validatorImagesForPredicate helpers; and
    buildPointerInputs covers the three outcome shapes (unsigned,
    signed-with-rekor, signed-without-rekor).

Notes:

  - ValidatorImages.Digest remains blank in this PR. The catalog
    records image refs by tag, not by digest; resolving each ref to a
    digest needs a registry round-trip per image, which validate's
    hot path avoids. Audit item #10 (BOM image digests) tracks the
    longer-term resolver path; the same resolver will populate this
    field when it lands.