CRA Self-Update Verification Fixture

This sample contains an offline fixture for stella self update --verify.

Files:

• product-update-manifest.tampered.dsse.json - DSSE envelope whose signature was created over the original product update statement, then the embedded payload was tampered by replacing the signer image digest.
• product-update-trust-root.pem - public trust root matching the key that signed the original payload.

Expected result:

cd docs/samples/cra-self-update
dotnet run --project ../../../src/Cli/StellaOps.Cli/StellaOps.Cli.csproj -- \
  self update --verify --dry-run \
  --manifest product-update-manifest.tampered.dsse.json \
  --trust-root product-update-trust-root.pem

The command must fail closed with a non-zero exit code and report signature_invalid:release-root.