Docs: add RFC for Sigstore integration for AgentCard supply chain verification

[kevincogan]

Summary

Adds the RFC for Sigstore integration into the kagenti-operator's AgentCard feature. This document proposes adding supply-chain provenance verification alongside the existing SPIRE/SPIFFE runtime identity system.

The RFC covers:

• Phase 1: SPIRE Sigstore image verification (config only, no Go code)
• Phase 2A: Move signing authority from init-container to operator
• Phase 2B: Sigstore bundle verification for agent card blobs
• Phase 3: Dual-layer status conditions and backend/UI integration
• Phase 4: OCI attestations and SPIRE attestor composition (future direction)

Key design decisions include using the SPIRE K8s attestor's built-in Sigstore support over a separate Policy Controller, a new BundleVerifier interface (Interface Segregation from the existing JWS Provider), and operator-level signing to eliminate the self-attestation trust gap identified in the PR #1038 review.

Related issue(s)

• Agent Attestation Epic #612 (Signal 4: Provenance)
• AgentCard UI Integration PR #1038 (review discussion that motivated the operator-signing pivot)

Testing Instructions

N/A - documentation only.