also looking at this

feat: verify and stage signed runtime images

#41

Merged chris wants to merge codex/runtime-updates into main

20 files +793 -7

b4730309cc build(deps): add pinned TUF verification libraries Chris Breuer review this step
20c6874c81 feat: verify and stage signed runtime images Chris Breuer review this step
07f57be4df build(deps): declare canonical JSON verification dependency Chris Breuer review this step
21bb022e6c fix: validate canonical TUF key identifiers Chris Breuer review this step
0a354d6378 fix: reject invalid firmware metadata dates and versions Chris Breuer review this step