[jmclong (jmclong)]

Summary

• Add the same Notation-based MCR verification
• Discover and deduplicate digest-pinned MCR FROM images from tracked Dockerfiles, including Dockerfile.manager.
• Pin the Notation action and Notation 1.3.2 download/checksum.
• Download Microsoft supply-chain and timestamp trust roots with pinned SHA-256 checksums, and enforce strict verification against the Microsoft supply-chain signer.
• Scope trust to the three base-image repositories used here and grant only contents: read.
• Document verification behavior in the development guide.

Scope

This verifies upstream MCR base-image signatures. It does not sign or verify the built driver/manager images, add a vulnerability gate, or modify the Trivy work in #686. Verification failures fail the new workflow, matching DACS.

Validation

• All three current base-image digests successfully verified with Notation 1.3.2 and this exact trust policy: Azure Linux core, Azure Linux distroless minimal, and Microsoft Go.
• The Notation archive and both downloaded trust roots matched their pinned checksums.
• Isolated discovery cases passed: both Dockerfile naming forms, --platform, case-insensitive FROM, deduplication, and non-MCR/stage references.
• Failure cases passed: unpinned reference, malformed digest, no MCR images, tracked missing Dockerfile, missing trust-store argument, and wrong trust-root checksum.
• All applicable pre-commit hooks passed, including actionlint, zizmor, ShellCheck, JSON/YAML checks, and Markdown/link checks; bash -n and git diff --check passed.
• Go builds and unit tests were not run because no Go or build inputs changed; validation exercised the new workflow helpers and actual remote signature verification.