feat: isolate privacy scanning and release signing

containers/privacy-worker-a/worker.mjs

@@ -0,0 +1,33 @@
+import { createHash } from "node:crypto";
+import { readFile, writeFile } from "node:fs/promises";
+
+const request = JSON.parse(await readFile("/input/request.json", "utf8"));
+if (
+  request.schema !== "portfolio-privacy-worker-request/v1" ||
+  request.workerId !== "worker-a" ||
+  !/^[a-f0-9]{64}$/u.test(request.inputDigest)
+)
+  throw new Error("Invalid worker request.");
+const bytes = await readFile("/input/object");
+const actual = createHash("sha256").update(bytes).digest("hex");
+if (actual !== request.inputDigest) throw new Error("Input digest mismatch.");
+const normalizedMembers = [`bytes:${actual}`];
+const normalizedOutputDigest = createHash("sha256")
+  .update(Buffer.from(JSON.stringify(normalizedMembers)))
+  .digest("hex");
+const output = {
+  schema: "portfolio-privacy-worker-report/v1",
+  workerId: "worker-a",
+  imageDigest: request.imageDigest,
+  toolchain: "bytes-js/v1",
+  inputDigest: actual,
+  checkId: request.checkId,
+  normalizedOutputDigest,
+  normalizedMembers,
+  verdict: "pass",
+  findingsDigest: "0".repeat(64),
+};
+await writeFile("/output/report.json", JSON.stringify(output), {
+  flag: "wx",
+  mode: 0o400,
+});