fix: bind final release authority and expiry

tests/deployment/headers.spec.ts

@@ -7,7 +7,7 @@ import { describe, expect, it } from 'vitest';
 import { canonicalValueBytes } from '../../src/security/canonical-digest.ts';
 
 // @ts-expect-error The production release checker is an executable ESM module.
-import { verifySupplyChainEvidence } from '../../scripts/supply-chain-check.mjs';
+import { verifySupplyChainEvidence, verifySupplyChainEvidenceForTest } from '../../scripts/supply-chain-check.mjs';
 
 const sha256 = (value: string | Buffer) => createHash('sha256').update(value).digest('hex');
 
@@ -87,10 +87,11 @@ async function evidenceFixture(overrides: Record<string, unknown> = {}) {
 }
 
 const verifyFixture = (fixture: Awaited<ReturnType<typeof evidenceFixture>>, extra: Record<string, unknown> = {}) =>
-  verifySupplyChainEvidence({
+  verifySupplyChainEvidenceForTest({
     projectRoot: fixture.root,
     evidenceDir: fixture.evidence,
     toolTrustPolicyPath: fixture.trustPolicyPath,
+    expectedCommitSha: 'b'.repeat(40),
     requireTrackedTriage: false,
     ...extra,
   });
@@ -151,4 +152,15 @@ describe('supply-chain evidence', () => {
     } });
     await expect(verifyFixture(unscanned)).rejects.toThrow(/repository|secret/u);
   });
+
+  it('keeps production authority and time non-caller-selectable', async () => {
+    const fixture = await evidenceFixture();
+    await expect(verifySupplyChainEvidence({
+      projectRoot: fixture.root,
+      evidenceDir: fixture.evidence,
+      toolTrustPolicyPath: fixture.trustPolicyPath,
+      now: '2026-09-02T12:00:00Z',
+      today: '2026-09-02',
+    })).rejects.toThrow(/production supply-chain request|unknown fields/u);
+  });
 });