fix: bind performance evidence to production resources

scripts/sign-drive-trace.mjs

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+import { createPrivateKey } from 'node:crypto';
+import { readFile, writeFile } from 'node:fs/promises';
+import { signReferenceCandidate } from './lib/reference-evidence.mjs';
+
+const args = process.argv.slice(2);
+if (args.length !== 6 || args[0] !== '--key-id' || args[2] !== '--private-key') {
+  throw new Error('Usage: sign-drive-trace --key-id ID --private-key PRIVATE_PEM INPUT_JSON OUTPUT_JSON');
+}
+const [, keyId, , privateKeyPath, inputPath, outputPath] = args;
+const [candidate, privateKeyPem] = await Promise.all([
+  readFile(inputPath, 'utf8').then(JSON.parse),
+  readFile(privateKeyPath, 'utf8'),
+]);
+const privateKey = createPrivateKey(privateKeyPem);
+if (privateKey.asymmetricKeyType !== 'ed25519') throw new Error('Reference results require an external Ed25519 private key.');
+const signed = signReferenceCandidate(candidate, { keyId, privateKey });
+await writeFile(outputPath, `${JSON.stringify(signed, null, 2)}\n`, { encoding: 'utf8', flag: 'wx', mode: 0o600 });