spec §2 reference signing workflow signs the checkout, not the packaged payload #77

spec-attestation-and-crl-workflows.md §2 step 3 has the reference developer
signing workflow run:

ocsign --path . --key <secret> --cert leaf.crt --chain intermediate.crt

In a GitHub Actions job . is the actions/checkout tree. In app mode the
manifest hashes everything under --path bar appinfo/signature.json and OS
cruft, so that command signs .git, tests/, .github/ and any build scratch
as part of the app — and the resulting signature.json verifies, because it
genuinely describes the tree that was signed.

This is not hypothetical: it is what shipped as
files_antivirus v1.3.1,
whose release archive carried the whole checkout with a manifest covering 537
paths including .git/config and .git/index.

owncloud/ocsign#21 makes ocsign refuse a --path that holds a .git entry,
so the workflow as specified now exits 1.

Fix: §2 should package the app payload first and point --path at the staging
directory (e.g. build/artifacts/appstore/<app>), signing before the tarball is
rolled. The step order in §2 currently signs (step 3) and packages (step 5) —
step 5 must produce the tarball from the tree that step 3 signed, which is the
payload, not the repo root. The full YAML in the developer-documentation spec
needs the same correction.