feat(user-verification): Introduce user verification on attestation init

[javirln]

This PR adds platform-based commit signature verification during attestation initialization. When creating an attestation, the system now queries GitHub or GitLab APIs to verify if the commit was signed and validated by the platform.

Extended the attestation initialization process to include commit signature verification status. The verification captures whether a commit's signature was validated by GitHub or GitLab, including details about the signature algorithm, key ID, and verification status.

Added new VerifyCommitSignature method to the SupportedRunner interface. Implemented verification for:

• GitHub Actions: Uses GitHub REST API with GITHUB_TOKEN
• GitLab CI: Uses GitLab API /signature endpoint with CI_JOB_TOKEN
• Dagger Pipeline: Detects underlying CI platform and delegates appropriately

Protobuf Schema

Extended Commit message with optional platform_verification field containing:

• Verification status (verified, unverified, unavailable, not applicable)
• Reason for the verification result
• Platform name (github, gitlab)
• Key ID and signature algorithm

Verification failures never block attestation creation. All errors result in recording the unavailable or not applicable status, allowing the attestation process to continue.

Example

Example from a GitHub Action. This is part of the crafting state:

"runnerType": "GITHUB_ACTION",
    "head": {
      "hash": "6a6f5761863d107f39df09b7cdc34a464c44a0f7",
      "authorEmail": "REDACTED",
      "authorName": "Javier Rodríguez",
      "message": "Update test-commit-verification.yml",
      "date": "2026-01-09T12:25:23Z",
      "remotes": [
        {
          "name": "origin",
          "url": "https://github.com/javirln/goreleaser"
        }
      ],
      "signature": "-----BEGIN PGP SIGNATURE-----SIGNATURE-----END PGP SIGNATURE-----\n\n",
      "platformVerification": {
        "attempted": true,
        "status": "VERIFICATION_STATUS_VERIFIED",
        "reason": "valid",
        "platform": "github",
        "signatureAlgorithm": "PGP"
      }
    },
    "signingOptions": {
      "timestampAuthorityUrl": "http://timestamp.digicert.com/",
      "signingCa": "fileCA"
    },

Example of attestation:

"annotations": {
  "author.email": "REDACTED",
  "author.name": "Javier Rodríguez",
  "author.verified": "VERIFICATION_STATUS_VERIFIED",
  "date": "2026-01-09T12:30:26Z",
  "message": "Update test-commit-verification.yml",
  "remotes": [
    {
      "name": "origin",
      "url": "https://github.com/javirln/goreleaser"
    }
  ],
  "signature": "-----BEGIN PGP SIGNATURE-----SIGNATURE-----END PGP SIGNATURE-----\n\n",
  "signature.algorithm": "PGP"
}

[jiparis]

Looks good to me, thanks!

[migmartri]

Thanks @javirln, see my comment about updating the annotations

[migmartri]

Btw, this feature is awesome, lert's make sure we update our docs and changelog to reflect it