Public export snapshot from bran-dev 94b66ce (Sigstore release contract + README)

[1wgrumph]

Public export snapshot produced by the approved exporter from a clean committed source.

Provenance

Source repository	alphazede/bran-dev
Source commit	94b66ce2ea63b434a7571ef614121ecb5ee963bd
BRAN version	0.1.0
Public export commit	4ad643e
Files in snapshot	122

What this brings public

Sigstore keyless release contract. The release signature moves from OpenPGP
to Sigstore cosign keyless via GitHub OIDC, so there is no long-lived key to
store, rotate, or leak. The manifest signature block now carries
certificate_identity and certificate_oidc_issuer in place of a key
fingerprint, the signature asset is SHA256SUMS.sigstore (a cosign bundle), and
release_seal.py verifies with cosign verify-blob. It fails closed when
cosign is absent, exactly as it previously failed closed without gpg. The
manifest stays at exactly seven assets.

Release workflow. .github/workflows/release.yml builds all five targets on
GitHub-hosted runners on a pushed bran-v* tag, then signs SHA256SUMS
keylessly and emits bran-release-manifest.json. The build job is restricted to
contents: read; only the signing job holds contents: write and
id-token: write. The workflow is exported publicly on purpose: the
certificate_identity names its path, so verifiers must be able to read it.

README rewrite. Replaces the hook-configuration tutorial that occupied most
of the file with install steps, a command table, and real captured output. Adds
the unmatched-entity miss behaviour, the offline-or-connected split with
concrete steps for connecting a model, and the keyless verification command.

Validation evidence

publish-hygiene PASS — files=242 markdown=8 packages=0 export_surfaces=1
PASS public snapshot: source_commit=94b66ce... files=122
PASS public drift guard: source_commit=94b66ce... files=122
cargo test -p bran-cli -p bran-core: 43 passed, 279 passed, 0 failed
PASS public boundary check: scanned=157 allowed_skips=1 allowed_binaries=1
PASS Phase 1 through Slice 3.4 fast gate   (exit 0)
bran check . bran-strict: pass, 0 diagnostics

Every exported file was scanned for credentials, private paths, and private
document roots. No stale reference to the OpenPGP contract remains anywhere in
the exported surface.

Merge method

Rebase-merge, not squash.