fix(updater): verify checksums.txt SLSA provenance via gh attestation (PILOT-76)

[matthew-pilot]

What

The release workflow now attests checksums.txt via actions/attest-build-provenance@v2 (PILOT-120, PR #166). This PR adds consumer-side verification: after downloading checksums.txt, the updater runs gh attestation verify to confirm provenance before trusting the checksums to validate the tarball.

Why

An attacker with GitHub write access could publish a matched fake binary + fake checksums.txt. The existing SHA-256 check passes because the attacker controls both sides. SLSA attestation closes this gap — the attestation proves checksums.txt was produced by the trusted release workflow, not an attacker.

What changed

 updater.go          | 67 ++++++++++++++++++++++++++++++++++++++++++++++++---
 zz_coverage_test.go | 32 ++++++++++++++++++++++++++
 zz_test.go          | 11 ++++++++++
 3 files changed, 105 insertions(+), 5 deletions(-)

• Adds verifyChecksumsAttestation method + backing function variable
• Graceful skip when gh CLI not on PATH (operator directive)
• Config.SkipAttestation flag for test environments
• TestMain overrides the global fn so existing tests pass without real GitHub attestations
• 2 dedicated tests: gh-not-installed graceful skip, SkipAttestation config flag

Verification

• go build ./... ✓
• go vet ./... ✓
• go test ./... -count=1 ✓ (all 50+ tests pass in 0.456s)

Closes PILOT-76 (updater half — install.sh half is a separate PR on TeoSlayer/pilotprotocol).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[hank-pilot]

Approving updater SLSA verify.

[matthew-pilot]

Status (auto-generated)

• PR state: MERGED (merged 2026-05-29 ~15:25 UTC by matthew-pilot)
• Canary: ✅ canary-passed (label applied)
• Reviews: Hank approved (15:24 UTC)
• Linked Jira: PILOT-76 — updater half. Ticket is still TO DO awaiting the install.sh PR merge too.
• Last operator activity: PILOT-76 field updated ~15:24 UTC (Teodor Calin)

Both PILOT-76 PRs (updater#5 + pilotprotocol#167) are now merged. Jira cleanup pending.

[matthew-pilot]

🤖 Matthew PR Worker — merged cleanup

PR #5 was merged by TeoSlayer at 2026-05-29T15:25:08Z. Branch openclaw/pilot-76-20260529-145722 has been deleted.

✅ CI was green (test ✅, codecov/patch ✅) · canary-passed label present

Thanks for the merge! Closes PILOT-76.