[V03] Publisher composition fixtures

[yunseo-kim]

Scope

Complete publisher/composition policy, handoff, sidecar, immutable, digest, permission, linked metadata, partial-write, and output fixtures.

Contracts

Publisher and composition specs

Dependencies

L04

Blocking issues: [L04] #42.

Executable QA

`go run ./cmd/slsa-builder-internal fixture-check --index testdata/fixtures/index.json --surface publisher,composition` must exit 0. `go test ./internal/releaseasset ./internal/composition -run '^TestFixtureCorpus$' -v` must exit 0 with zero forbidden DELETE/overwrite calls.