feat(transparency): make the signing wire operable — GT-588 criterion 1

[beyondnetPeru]

The wire existed and was tested — a decorator over IAuditEntryRepository, a Merkle tree, COSE_Sign1, a JSONL ledger, and a cross-language interop job in CI. And still nothing was signed in any environment, for a reason that was not in the code: the chart did not declare the switch.

Transparency appeared in no values.yaml, no configmap and no deployment. An operator holding real keys had no way to turn it on short of inventing a --set over a key that does not exist — which Helm accepts in silence and which enables nothing.

What ships

values.yaml	declares the switch, off, with ledger path, issuer/transparency-service identities and the secret key names
configmap	emits the non-secret keys only when signing is on — same reason as Otlp: a key in the configmap suggests there is a signed record when there is not
deployment	reads both Ed25519 seeds from an existing Secret. The chart never generates, defaults or versions key material
ledger volume	its own PVC, and asking for persistence without a claim fails the render rather than quietly mounting an emptyDir under the name of a persistent volume

A ledger on the pod's ephemeral filesystem is erased on every restart, and a transparency log that deletes itself is exactly what the gap calls decorative.

The tests read the chart, not the code

Deliberately. What was missing was the operating surface, and a test over the classes would have stayed green for the whole time the gap was open — the same lesson ObservabilityConventionTests already recorded for traces.

• The default is still off — verified by flipping it to true and watching the test go red, not assumed.
• The wire must stay a decorator: a list of explicit callers only signs the paths somebody remembered, and the fifth path added tomorrow would go unsigned.
• The chart must carry no seed material — a default seed would make the ledger look signed while proving nothing, which invites trust and is worse than no ledger.

The criterion is still not met, and the row says so

No environment enables this yet. Doing so needs two distinct Ed25519 seeds in a secret store and a PVC — key custody is an owner decision, not a code change. What changed is that it went from impossible without touching code to a deployment decision, and product/infra/helm/README.md now documents exactly how.

🤖 Generated with Claude Code