[§9.3] Cosign everything, fail-closed; fail build on policy drift

[mdheller]

Agentic-Stack §9 action 3. Sign all agents/validators/artifacts with cosign; A2A refuses negotiation on bundle/attestation failure; CI fails closed on missing/invalid signatures and on policy drift. Part of epic SocioProphet/socioprophet#490.