feat(dashboard): per-image signing inventory in the Admission view (JEF-262)

[thejefflarson]

Closes JEF-262

What

Surfaces JEF-261's observed signing posture for every image as a dedicated signing-inventory section in the Admission tab, between the tallies header and the decision log. It replaces the misleading gate vocabulary (n/a + "would admit" for everything ungated) with two hard operator rules:

1. Signature posture is always one of signed / invalid signature / not signed (or the transient checking…) — never n/a.
2. The "if enforced" column is always the binary would admit / would block — never n/a (only a verifying signature would admit; everything else is fail-closed).

Changes (presentation only)

• view_model/props.rs — new presentation SigningPosture enum + SignerProps / SigningRowProps / SigningRepoProps. Presentation mirror only; the domain signature::posture::SigningPosture is never imported into components. Removed the signature gate field from DecisionRowProps.
• view_model/signing_inventory.rs (new) — partitions the sweep's Image/<ref> observation rows out of the decision log; derives a short signer label (GitHub Actions SAN → org/repo, email kept verbatim) + issuer badge (github actions / google / sigstore / host) from the untrusted Fulcio SAN; splits each image into repo + digest/tag; groups images under their repo. The producer (JEF-261 sweep) is untouched.
• view_model/admission.rs — tallies are now derived from the webhook decision rows alone (summing the deduped counts == the log's own tallies), so pure observation rows no longer inflate admitted/audited/denied. build_admission_view drops its now-redundant tallies param.
• components/admission_view.rs — new signing-inventory section reusing the gate-chip glyph+word vocabulary, the <table> grid, and the <details> expand pattern. invalid is the loud channel (breach keyline); plain not signed is calm. Each posture carries colour + glyph + word. The ref + signer line truncate in-row with a single-line ellipsis (never break-all); the full ref/SAN/issuer live in the expand panel + title=. Honest empty: "no images observed yet" (explicitly not an all-clear). Removed the old signature gate column from the decision log.
• dashboard.css — .signing table shares the .decisions grid; --sign-* chip tokens; ellipsis truncation. Light-theme tokens only; no raw hex; no inline style=.
• docs/STYLEGUIDE.md — added the signing-posture enum to the colour-not-alone gate + component→token map.
• examples/dashboard_preview.rs — seeded the sample log with every posture so the section renders across scenarios.

Decision recorded

• Deriving would-admit from posture (not record.would_admit): the sweep records observation rows with the default would_admit = true; rendering that verbatim is exactly the misleading "green stamp" the ticket kills. The binary is derived from the posture in the view_model layer (signed → admit; invalid / not-signed / checking → block), which honors "adapt in your view_model layer, don't modify the producer."
• Tallies exclude observation rows: JEF-261 records Image/<ref> sweep rows with decision allow into the same log, so log.tallies() counted them as admits. Recomputing the header counts from the decision rows in the view_model keeps the admitted/audited/denied honest without touching the producer.

Tests

• view_model/signing_inventory (new): signed-with-identity (org/repo + badge), email signer, no-issuer, invalid, not-signed, checking, unknown→checking, would-admit binary, repo grouping, digest/tag/port ref splitting, partitioning, empty, dedup count.
• Admission render tests (new): every posture renders its distinct word + no n/a; short signer + issuer badge + full SAN available; escaping of an attacker-chosen identity; would-admit / would-block; honest empty. Existing decision-log tests updated for the removed signature column + derived tallies.

Checks

cargo fmt --check · cargo build · cargo build --example dashboard_preview · cargo clippy --all-targets (clean) · cargo test — 401 unit + 9 dashboard guards + file-size guard all green.

🤖 Generated with Claude Code