Migrate policy evaluation consumers to read from CAS instead of inline predicate #2950

Context

In #2949 we introduced PolicyEvaluationBundle CAS storage: during attestation push, policy evaluations are serialized as a protobuf bundle, uploaded to CAS, and referenced from the attestation predicate via policyEvaluationsRef (a ResourceDescriptor with digest and media type). The inline policyEvaluations field in the predicate is now marked as deprecated.

Problem

Today, all consumers read policy evaluations from the inline policyEvaluations field embedded in the attestation predicate JSON stored in the database. This is the field we want to eventually remove to reduce attestation envelope bloat.

Key read path: WorkflowRunService.View() → bizAttestationToPb() → chainloop.ExtractPredicate() → predicate.GetPolicyEvaluations() → extractPolicyEvaluations().

Proposed approach

Update GetPolicyEvaluations() (or its callers) to:

1. Check if policyEvaluationsRef exists in the predicate
2. If yes, download the PolicyEvaluationBundle from CAS using the digest, deserialize, and return
3. If no ref (older attestations), fall back to the inline policyEvaluations field

Once all consumers have migrated, the inline policyEvaluations field can be stripped or reduced from the predicate during rendering, completing the attestation size reduction.

Considerations

• The control plane needs CAS download capabilities (already available via pkg/blobmanager/ Downloader interface)
• CAS downloads add latency; caching should be considered for frequently accessed attestations
• Backward compatibility with older attestations that only have inline data must be preserved