[muscariello]

Stack: #61 ← #65 ← #67 ← #66. Review and merge in that order; each PR shows only its own commits.

Closes #64. Needs Agent-Card/ai-catalog-rust#64, and Agent-Card/ai-catalog-rust#61 through #67.

Change

• CLI: cosign sign-blob --bundle already writes a Sigstore bundle; the CLI used to keep only the raw signature from it. It now passes both to attach_cosign_verification_artifacts_with_bundle, so the signature referrer has two layers:
  1. the raw signature (application/vnd.dev.sigstore.cosign.signature), unchanged, for existing consumers;
  2. the bundle (application/vnd.dev.sigstore.bundle.v0.3+json).
• README: verification now uses cosign verify-blob --bundle, and notes that offline-signed bundles also need --insecure-ignore-tlog=true.

Dependencies

ai-catalog-rust 0.4.0 includes Agent-Card/ai-catalog-rust#61, #63 and #64, and #61 here is bumped to it, so this builds against released crates and CI passes.

Testing

Tested against the released 0.4.0 crates: 67 + 37 tests pass.

• cargo test passes, including a new assertion that the signature referrer's layers are [signature, bundle].
• cargo clippy --all-targets --all-features -- -D warnings and cargo fmt --check pass.
• End to end with cosign v3.1.4: oci export-layout --cosign-key on a two-manifest catalog stores both layers, and cosign verify-blob --key … --bundle <stored bundle> --insecure-ignore-tlog=true <payload> gives Verified OK.

Timestamp note

Now that bundles are stored, the second commit removes #65's temporary --sigstore-services tsa note and its README sentence: log entries and timestamps are kept in the stored bundle.