R8 for the Windows installer: install.ps1 still pulls from a mutable branch, unverified (RFC-0001 R8 — Windows)

[saadqbal]

RFC-0001 R8 — Windows side (tracebloc/backend#889, epic tracebloc/backend#830).

The R8 PRs hardened the bash path: install.sh + sub-scripts now pin to an immutable release tag, verify a cosign-signed manifest before running anything, and fail closed (#281); the CLI installer's cosign is mandatory (cli#111). The Windows entrypoint is untouched — confirmed no .ps1 in #281. So irm https://.../install.ps1 | iex (and install-k8s.ps1) still pull sub-scripts from the mutable main branch with no signature — the same R8 supply-chain gap, Windows side.

Scope

• Apply the equivalent hardening to install.ps1 + install-k8s.ps1: pin to the immutable release tag, verify each sub-script against the same signed manifest (cosign verify-blob on Windows), fail closed when verification can't complete.
• The bash entrypoint auto-update is handled by the website i.sh shim (tracebloc-website#366); the PowerShell entrypoint needs the analogous "serve/run from the latest signed release" treatment.

Refs: tracebloc/backend#830, tracebloc/backend#889, #281, cli#111.

[saadqbal]

Landed on develop via #299 (squash 0b70b16) — install.ps1 now pins to the immutable release tag, cosign-verifies install-k8s.ps1 against the signed manifest, and fails closed; the manifest + CODEOWNERS + release workflow cover the Windows entrypoint too.

Keeping this open until it ships to prod: the protection goes live when the next client release is cut (that's what stamps install.ps1 and publishes it + the manifest as release assets). Until then releases/latest/download/install.ps1 still 404s. Closes on the develop→main release.

[saadqbal]

Verified live in v1.8.5 (https://github.com/tracebloc/client/releases/tag/v1.8.5):

• install.ps1 published as a release asset with $DefaultRef stamped to v1.8.5.
• releases/latest/download/install.ps1 → 200 (pinned irm | iex entrypoint resolves).
• manifest.sha256 covers scripts/install-k8s.ps1; cosign verify-blob of the signature → Verified OK (client release-workflow keyless identity).
• Bootstrap fails closed on a mutable/unstamped ref or a digest mismatch.

RFC-0001 R8 now covers both entrypoints (install.sh + install.ps1).