Verifying artifacts

Status: stub. Day 5 deliverable — full cosign verification recipe with a real published key fingerprint.

Three things are independently verifiable, with three commands.

1. The CLI binary

cosign verify-blob \
  --certificate-identity-regexp 'https://github.com/futami-worker-os/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --signature wos.mjs.sig wos.mjs

2. A decision receipt

cosign verify-blob \
  --key https://worker-os.com/pgp-key.asc \
  --signature receipt.sig receipt.json

3. The Merkle root anchored to Bitcoin

ots verify rollup-2026-05-10.ots

If all three pass, the decision is reproducible from the input bytes plus the policy bytes plus the published key.