Hardening a CI/CD Supply Chain to SLSA Level 3

How we made a build pipeline tamper-evident end to end: hermetic builds, KMS-signed provenance, and an admission gate that refuses anything it cannot verify.