feat(release-policy): Add trustee policy flow

[shariqahmed-cohere]

This PR adds everything required to get this repo to generate and release trustee-compatible policies for Azure SEV-SNP nodes.

---

Note

High Risk
Changes expand attestation policy generation, pin Azure paravisor/PCR/TCB values, and tighten GPU certificate checks—errors could deny legitimate nodes or weaken admission controls.

Overview
Adds Trustee policy generation and release alongside the existing ITA path: the generate-policy action now accepts trustee in policy-types, emits trustee_policy_cpu.rego and trustee_policy_gpu.rego (Azure az-snp-vtpm PCR pins plus NRAS-style GPU rules), and exposes new action outputs. A TrusteeRenderer measures Azure targets via cvm-measure azure-snp, fills CPU/GPU Rego templates, and records a trustee_policies block in the signed predicate.

Release and CI now generate ita trustee, attest all policy files plus the manifest in one Sigstore bundle, ship Trustee assets on GitHub releases, and extend workflow tests so ITA-only runs never perform Azure measurement.

Shared measurement plumbing renames TDX computation to compute_tdx_measurements, adds compute_azure_snp_pcrs, bumps the pinned cvm-measure commit in the action image, and merges renderer-level predicate_metadata into predicate.json.

ITA policy hardening adds NVIDIA OCSP checks on attestation and RIM cert chains, requires dbgstat == "disabled", and aligns driver-version wording with Trustee.

Tests and docs add test_trustee_policy.py with OPA appraisal fixtures, ITA revocation/debug cases, an Azure SNP row in the test manifest, and README updates for the dual-pipeline flow.

^{Reviewed by Cursor Bugbot for commit ee99147. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Release trigger misses policy constants

Medium Severity

The release workflow path filter lists the Trustee templates but not trustee.py, where the load-bearing AZSNP_PARAVISOR_MEASUREMENTS and AZSNP_MIN_TCB values actually live. Adding a new paravisor measurement to ride out an Azure firmware roll, or raising a TCB floor, can land on main without generating or publishing a new policy.

Additional Locations (1)

• .github/actions/generate-policy/generate_policy/trustee.py#L53-L69

 

^{Reviewed by Cursor Bugbot for commit 4a179ff. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 692a02f. Configure here.}

[cursor]

Stale comment

Agentic security review of this Trustee policy PR found one net-new HIGH issue: diagnostic print() of full Kata agent request input in the new Azure SNP initdata, which can leak secret-bearing OCI env to host-visible logs. Other issues already covered on this PR (test targets in the production manifest; release path filter omitting trustee.py) were not re-posted.

  

_{Sent by Cursor Security Agent: Security Reviewer}