assurance: nested PCS bundle fixture and import tests

[fraware]

Why this helps

Assurance import already supports pcs.mode=bundle (nested signed PCS bundle via import_signed_bundle in pipeline/src/sm_pipeline/assurance/import_/__init__.py), but tests and release fixtures only exercise none / claim_pointers. write_release_bundle always sets bundle_path: null. Contributors integrating with pcs-core lack a golden path to prove nested import fail-closed behavior and successful write.

Scope

Add a minimal nested-bundle fixture path and pytest coverage for pcs.mode=bundle: happy path when a valid signed bundle is present (skip or xfail cleanly when pcs-core / local PCS fixtures are unavailable), and fail-closed when the bundle file is missing or import fails. Document how to refresh the nested fixture when pcs-core is available (docs/assurance/import.md, optionally docs/pcs/README.md).

Suggested starting points

• pipeline/src/sm_pipeline/assurance/import_/__init__.py (pcs.mode == "bundle")
• pipeline/tests/assurance_fixtures.py (write_release_bundle, pcs_mode)
• pipeline/tests/test_assurance_layer.py (existing claim_pointers coverage)
• docs/assurance/import.md (Nested PCS table)
• Existing PCS fixtures under corpus/pcs/ and refresh scripts (just refresh-pcs-release, scripts/refresh_pcs_release.py)
• Pilot layout note: tests/assurance/fixtures/pilot-*/pcs/ exists but pilots use "mode": "none"

Acceptance criteria

• Fixture helper can emit pcs.mode=bundle with a relative bundle_path under the release pcs/ directory
• Test: missing bundle file raises AssuranceValidationError
• Test: successful nested import when a maintainer-supplied or repo-pinned signed bundle is available; clear skip message when unavailable
• Docs in docs/assurance/import.md describe how to obtain/refresh the nested bundle from pcs-core
• No new PCS wire formats; reuse existing PCS importer only
• Assurance non-claims unchanged (no claim digest/status rewrite)

Non-goals

• Making pcs-core a hard dependency of default CI for all contributors
• Changing claim_pointers semantics or rewriting pilots to require bundle mode
• Portal UI work

How to test

uv run --project pipeline pytest pipeline/tests/test_assurance_layer.py -q -k "bundle"
# When pcs-core / refresh path is available:
just refresh-pcs-release
# or: python scripts/refresh_pcs_release.py
uv run --project pipeline sm import-assurance-release path/to/release-with-nested-pcs/ --dry-run
uv run --project pipeline sm import-assurance-release path/to/release-with-nested-pcs/
uv run --project pipeline sm validate-action-chain ACTION_ID

Label note: prefer help wanted (and python); treat as intermediate rather than absolute first issue if pcs-core setup is required locally.