fix: bind performance evidence to production resources

scripts/lib/reference-evidence.d.mts

@@ -0,0 +1,10 @@
+import type { KeyLike } from 'node:crypto';
+
+export function signReferenceCandidate(
+  candidate: Readonly<Record<string, unknown>>,
+  signer: { keyId: string; privateKey: KeyLike },
+): Record<string, unknown>;
+export function verifySignedReferenceRun(
+  run: Readonly<Record<string, unknown>>,
+  policy: { schema: string; keyId: string; publicKeyPem: string },
+): Record<string, unknown>;