fix(assessment): keep release origin unproven

docs/installed-composition-evidence.schema.json

@@ -20,7 +20,7 @@
       "format": "uri-reference"
     },
     "schema_version": {
-      "const": "0.2.0"
+      "const": "0.3.0"
     },
     "evidence_kind": {
       "const": "govoplan.installed-composition"
@@ -122,8 +122,11 @@
         {
           "type": "object",
           "additionalProperties": false,
-          "required": ["kind", "commit"],
+          "required": ["basis", "kind", "commit"],
           "properties": {
+            "basis": {
+              "const": "local-pep610-metadata"
+            },
             "kind": {
               "const": "vcs-commit"
             },
@@ -136,8 +139,11 @@
         {
           "type": "object",
           "additionalProperties": false,
-          "required": ["kind", "sha256"],
+          "required": ["basis", "kind", "sha256"],
           "properties": {
+            "basis": {
+              "const": "local-pep610-metadata"
+            },
             "kind": {
               "const": "archive"
             },
@@ -149,8 +155,11 @@
         {
           "type": "object",
           "additionalProperties": false,
-          "required": ["kind"],
+          "required": ["basis", "kind"],
           "properties": {
+            "basis": {
+              "const": "local-pep610-metadata"
+            },
             "kind": {
               "enum": [
                 "editable-local",