How are tool manifests secured against tampering?

Every tool manifest is signed with RSA-4096 using SHA-256 before it leaves the CI pipeline.

Verification points:

• Container fetch — verified when the Fly.io container fetches the manifest from Cloudflare R2
• Agent push — verified when the manifest is pushed to a connected Go Agent
• Agent restart — verified on every agent restart

An unsigned or tampered manifest is rejected entirely. There is no "warn but continue" mode in production.

Key separation:

• Manifest signing key — lives in GitHub CI secrets
• Agent config signing key — lives in a Cloudflare Worker (private key never touches a Fly.io container or customer server)
• Compromise isolation — a compromise of one signing environment does not affect the other