Redacted excerpt; full evidence withheld.

$ cd <host-path> && git log -1 --format=%H 2>/dev/null; ls -la; cat README.md 2>/dev/null | head -200
exit: 0
he always-on hashes:

- **HMAC (pipeline integrity).** Set `PRESIDIO_MANIFEST_HMAC_KEY` and the
  manifest gains an HMAC-SHA256 signature; verification on a host with the same
  key confirms the manifest came from your pipeline. Symmetric — proves
  provenance within a trust boundary you control, not non-repudiation.
- **Detached cosign (distribution).** For third-party verification, sign the
  manifest *blob* out of band exactly as the release pipeline signs images:
  `cosign sign-blob scoutsuite-report/presidio-report-manifest.json`.

[excerpt truncated]