Expose bounded deployment-source attestation

#9
by betterwithage - opened

Add only GET /.well-known/szl-source.json ahead of the existing fallback. Measure the HF head independently; pin a verifiable GitHub reference without claiming parity, reproducible builds, or build provenance.

Merged after existing contracts, targeted route tests, and runtime-preservation checks passed.

betterwithage changed pull request status to merged

Sign up or log in to comment