security: add staging supervisory API acceptance gate

[munisp]

Summary

• Adds a deployment-blocking staging supervisory API acceptance workflow.
• Runs dependency-free contract checks on relevant pull requests without secrets.
• Runs protected mTLS integration checks only after a successful staging deployment, or an environment-approved manual revalidation.
• Requires the staging gateway to return the exact candidate OCI digest and validates TLS 1.3, active-plus-next SPKI pins, certificate-bound token behavior, read-only API behavior, scope concealment, integrity-failure behavior, and minimized SSE events.
• Adds the mTLS trust-bundle and SPKI pin disaster-recovery/key-rotation procedure.

Security properties

The live test uses only staging environment secrets, short-lived non-production mTLS material, and a self-hosted staging runner. Private key material is created under the runner temporary directory with restrictive permissions and is removed in an always() cleanup step. Job summaries contain only the candidate digest, deployment reference and outcome.

Validation

• node --test tests/supervisory-api-contract/test/schema-contract.test.mjs — 9 passing tests.
• YAML structural validation passed for .github/workflows/staging-supervisory-api-acceptance.yml.
• git diff --check passed.

Required environment setup before enabling the live job

Create the protected staging-supervisory-acceptance environment, restrict it to the staging branch/deployment flow, require designated reviewers, and populate the secrets documented in tests/supervisory-api-contract/README.md. The staging deployment controller must provide deployment.payload.image_digest as a full immutable OCI digest.