Fix runtime distribution signing environment

.gitea/workflows/runtime-distribution.yml

@@ -202,7 +202,7 @@ jobs:
             --dependency "test_mail=$TEST_MAIL_IMAGE" \
             --output-directory runtime-output/evidence \
             --descriptor runtime-output/distribution-descriptor.json
-          python tools/release/generate-runtime-distribution.py \
+          .runtime-build/bin/python tools/release/generate-runtime-distribution.py \
             --descriptor runtime-output/distribution-descriptor.json \
             --signing-key "$SIGNING_KEY_ID=runtime-output/signing-key.pem" \
             --output runtime-output/distribution-manifest.json

docs/INSTALLATION_AND_DEPLOYMENT_ARCHITECTURE.md

@@ -145,7 +145,9 @@ installation. Separate amd64/arm64 API and WebUI images are joined into OCI
 indexes and run as non-root identities. The release assets include CycloneDX
 application SBOMs, SLSA-style provenance, exact composition evidence, the
 single-file deployer, its detached Ed25519 signature, and a signed, expiring
-distribution manifest.
+distribution manifest. Evidence generation and signing run through the
+workflow's isolated release Python environment so their cryptographic tooling
+is explicit and independent of packages preinstalled in the Actions runner.
 
 The manifest contract is
 [`runtime-distribution-manifest.schema.json`](runtime-distribution-manifest.schema.json),

tests/test_runtime_distribution_build.py

@@ -29,6 +29,20 @@ FINALIZE = _load(
 
 
 class RuntimeDistributionBuildTests(unittest.TestCase):
+    def test_workflow_signs_with_the_release_environment(self) -> None:
+        workflow = (ROOT / ".gitea/workflows/runtime-distribution.yml").read_text(
+            encoding="utf-8"
+        )
+
+        self.assertIn(
+            ".runtime-build/bin/python tools/release/generate-runtime-distribution.py",
+            workflow,
+        )
+        self.assertNotIn(
+            "\n          python tools/release/generate-runtime-distribution.py",
+            workflow,
+        )
+
     def test_resolves_platforms_and_builds_evidence_descriptor(self) -> None:
         index = {
             "schemaVersion": 2,