feat: verify build attestations and review submissions with Pullfrog

[afonsojramos]

Summary

Every store submission now gets an AI security review that reads the source the zip was actually built from.

• Provenance. validate-submission.ts verifies each new artifact's attestation with gh attestation verify, requiring the spicetify/actions build-module workflow as signer, a GitHub-hosted runner, and the repository named in the artifact's own metadata.repository. It reports the source commit, or why the artifact is unverified. The check is informational: an unattested module still validates.
• Submission workflow. Gets a read-only token for the lookup and keeps the report as a provenance artifact.
• Submission review. A new pull_request_target workflow recomputes provenance from base-branch code, reading the pull request only as data, then runs Pullfrog with a committed prompt (.github/submission-review.md). The reviewer clones the author's repository at the attested commit, or unpacks the artifact when there is no attestation, checks it against a Spicetify-specific list (network access, remote and dynamic code, Spotify credentials, the daemon token and CORS proxy, module-installing localStorage writes, concealment, supply chain, loader hangs), and posts one review that never approves. Pullfrog runs with push: disabled and shell: restricted, and every action in this workflow is pinned by SHA because it holds model keys on fork pull requests.
• Docs. docs/publishing.md describes attested builds and the review.

Builder side: spicetify/actions#4.

Validation

• pnpm fmt:check, pnpm check, and the full pnpm test pass (816 passed, 29 skipped); the validator suite has 30 tests, including parsing of a real gh verification result.
• verifyWithGh against real artifacts: Add section-marker-rev to vault #55 reports no attestation; the CLI's own release binary reports it was signed by rust-release.yml, not build-module.
• The review workflow's provenance and context steps were run locally against Add section-marker-rev to vault #55 and produce the prompt context the reviewer receives.
• actionlint passes; zizmor reports nothing on submission-review.yml.

Not yet exercised:

• A real build-module attestation passing the validator, which needs the builder PR's run.
• A Pullfrog review run. pull_request_target and workflow_dispatch both read the workflow from the default branch, so the first run happens after merge; workflow_dispatch with a pull request number then re-reviews open submissions such as Add section-marker-rev to vault #55.
• The repository has no Actions secrets, so the run relies on the model key configured in Pullfrog.

[pullfrog]

This run was cancelled 🛑

The workflow was cancelled before completion. Please check the link below for details.

  ^{｜ View workflow run ｜ via Pullfrog ｜ 𝕏}