[Feature]: Implement Sigstore Policy Controller for SLSA Build Provenance Verification

[mchmarny]

Prerequisites

• I searched existing issues

Feature Summary

Replace Kyverno-based image admission policy with Sigstore Policy Controller to automatically verify SLSA Build Provenance attestations for NVSentinel container images at deployment time.

Problem/Use Case

NVSentinel container images are are now built with SLSA Build Level 3 provenance attestations. Currently, there is no automated verification of these attestations when deploying to Kubernetes clusters.

Proposed Solution

• Document use of Sigstore Policy Controller
• Implement keyless verification using GitHub Actions OIDC identity
• Validate SLSA provenance attestations with CUE policy language
• Provide automated setup script for easy deployment
• Update documentation with verification examples

Component

Health Monitor

[mchmarny]

Closed by #189