fix(release): refresh v0.22 image advisories

[jeremi]

What changed

• rebind the Relay, Evidence, and Mint advisory baselines to the reviewed v0.22.0 Linux AMD64 candidate bytes
• preserve the existing policies, invalidation triggers, component layer, owners, severities, and 2026-08-28 expiry
• update the live whole-image fingerprint test fixtures to the same official candidate provenance

Why

The v0.22.0 application layers and service binaries changed while the reviewed base image, libc component layer, runtime process contracts, and four shared runtime-library fingerprints remained unchanged. The three existing Debian Trixie libc findings still have no compatible fix and remain bound to exact reviewed bytes.

Validation

• exact Grype, Syft, OCI-config, and rootfs checks for Relay, Evidence, and Mint: 14 findings, 3 blocking findings, 3 matching exceptions, 0 invalidations each
• advisory baseline unit tests: 45 passed, 1 skipped
• full release script test discovery passed
• release gate inventory passed for 151 gates
• full actionlint passed
• git diff --check passed
• independent security diff review found no issues

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 007a4e0925

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add the required DCO sign-off

Commit 7eac9b8d808a325e3651026fc5391da629865906 has no Signed-off-by trailer, so the repository's DCO workflow will reject it. Recreate the commit with git commit -s or otherwise add a valid sign-off trailer.

AGENTS.md reference: AGENTS.md:L272-L274

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Split the change along ownership boundaries

This commit combines a products/relay-v2 baseline update with release-owned Evidence/Mint baselines and release tests. The repository explicitly requires each change to remain within one owning area, so separate the Relay product update from the release/ update.

AGENTS.md reference: AGENTS.md:L280-L282

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Align the release runbook with the new provenance

Changing Evidence and Mint to official_candidate makes release/OPERATIONS.md:241-244 false: it still says Relay uses the v0.20.1 official candidate while Evidence and Mint use local v0.20.1 reproductions because official reports were unavailable. Update that operational description to reflect the reviewed v0.22.0 candidates so later advisory renewals and security reviews do not rely on obsolete provenance.

Useful? React with 👍 / 👎.