neelagiri65/equiv review

Check that refactors preserve behaviour, on every PR. Deterministic, signed receipts.

Trust Signals

name	description	required	default
auto	Auto-detect changed functions from the PR diff instead of a manifest. Recommended: nothing changed can be silently left unchecked. Functions without supported type hints are reported as "changed, not checked".	no	false
manifest	Path to the equiv review manifest (lines: `file : fn : sig`). Ignored when auto is true.	no	.equiv-review
base	Base git ref to diff against.	no	""
fail-on-divergence	Fail the check when any function changed behaviour.	no	true
signing-key	Optional ed25519 seed (64 hex chars) used to sign receipts (v0 self-attestation). Pass it from a repository secret. Empty on fork PRs by design; receipts are then left unsigned. Never use pull_request_target to force it. See docs/signing-model.md.	no	""
keyless	When "true", keyless-sign each in-toto attestation with cosign (Sigstore): OIDC workload identity -> Fulcio short-lived cert -> Rekor transparency log. No long-lived secret. Requires `permissions: id-token: write` in the calling workflow. This is the recommended trust model (DR-3).	no	false

no outputs