fix(security): bind release evidence to immutable image digests

[FelixTJDietrich]

Description

Reconciles the security baseline with the source and immutable production image digests we actually ship. Release evidence is now subject-bound and re-verifiable: each supported image platform publishes SBOM, license, vulnerability, provenance, signature, and policy evidence, while recurring rescans authenticate the signed release lock before scanning the same digests.

High and critical findings fail the release unless an exception identifies the exact image, platform, digest, package, and installed version and includes an owner, HTTPS evidence, a structured status, and an expiry within 90 days. This also applies explicit least-privilege workflow permissions and updates the supported Netty and OpenAPI generator versions.

This PR establishes the pipeline and policy required by the issue. The final acceptance criterion—proving the complete evidence set in a public release—must be completed with the first release candidate after merge; historical release evidence is intentionally left immutable.

Fixes #1569

How to test

• Run bun run verify to execute the complete local CI mirror, including 7,098 server tests, 992 webapp tests, Storybook browser tests, production builds, documentation checks, and release-policy tests.
• Run bun test scripts/check-release-vulnerabilities.test.ts scripts/check-release-sbom.test.ts scripts/release-image-lock.test.ts for the focused evidence and negative-path suite.
• After merge, create the next release candidate and run the clean-environment verifier against every supported image and platform.
• Confirm the deployment consumes the verified signed lock, then trigger the recurring rescan and compare its immutable digests with the release manifest.

Checklist

• My changeset summary reads as an operator/user-facing note (it becomes the changelog entry) — see .changeset/README.md
• If the operator must act on this change (new required env var, manual migration step), the changeset summary says how (**Operators:** …) and MIGRATION.md is updated

[coderabbitai]

Warning

Review limit reached

Next included review available in 13 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 20cf9444-a621-4808-b22a-98303e8db645

📥 Commits

Reviewing files that changed from the base of the PR and between c088409 and d764e4c.

📒 Files selected for processing (10)

• .changeset/bind-release-security-evidence.md
• .github/workflows/ci-docker-build.yml
• .github/workflows/cicd.yml
• .github/workflows/release.yml
• .github/workflows/rescan-release-images.yml
• docs/contributor/release-management.mdx
• scripts/check-release-vulnerabilities.test.ts
• scripts/check-release-vulnerabilities.ts
• security/vulnerability-policy.json
• server/pom.xml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📚 Documentation Preview

Preview has been removed (PR closed)

[github-actions]

🧩 Storybook Preview

Review this pull request's components and interaction states:

🔗 View Storybook Preview

_{Preview for commit d764e4c. Updates automatically on new commits.}