also looking at this

feat: enroll protected runtime trust anchors

#43

Merged chris wants to merge codex/runtime-trust-enrollment into main

33 files +1297 -18

b4730309cc build(deps): add pinned TUF verification libraries Chris Breuer review this step
20c6874c81 feat: verify and stage signed runtime images Chris Breuer review this step
07f57be4df build(deps): declare canonical JSON verification dependency Chris Breuer review this step
21bb022e6c fix: validate canonical TUF key identifiers Chris Breuer review this step
0a354d6378 fix: reject invalid firmware metadata dates and versions Chris Breuer review this step
416073e88b feat: enroll protected runtime trust anchors Chris Breuer review this step
981e17c2cd test: retain partial execution failure diagnostics Chris Breuer review this step