Add honest deployment-source attestation

#2
by betterwithage - opened

Expose /.well-known/szl-source.json with a measured HF revision. Separate deployment identity from GitHub observations; explicitly do not claim GitHub parity or reproducible builds.

Merged after full local contract suite and pinned source-evidence checks passed.

betterwithage changed pull request status to merged

Sign up or log in to comment