Prepare setup-astrid v2 release

[joshuajbouw]

Summary

Prepare the canonical Astrid Runtime setup action for its v2 tag without publishing that tag before review and merge.

Changes

• Extract Sigstore workflow-identity verification into a testable script.
• Preserve strict support for both the current astrid-runtime/astrid identity and historical unicity-astrid/astrid release identity.
• Keep fork/mirror and explicit identity overrides exact, with no legacy fallback.
• Add regression coverage for current, historical, fork, override, and failure paths.
• Repair the README input table and document the v1-to-v2 boundary.
• Add the signed-tag release procedure for immutable v2.0.0 and moving v2.

Impact

The README's astrid-runtime/setup-astrid@v2 examples become publishable from the reviewed main commit. Existing v1 consumers remain untouched.

Verification

• scripts/test-release-identity.sh
• bash -n scripts/verify-release-identity.sh scripts/test-release-identity.sh
• shellcheck scripts/verify-release-identity.sh scripts/test-release-identity.sh
• Parsed action.yml and .github/workflows/test.yml with Ruby YAML.
• git diff --check
• Signed commit verified locally.

Post-merge release step

Do not create the tags from this branch. After this PR is merged and main is green, follow RELEASING.md to sign and atomically push v2.0.0 and v2, then dispatch test.yml against v2.

[Copilot]

Pull request overview

Prepares setup-astrid for a v2 major tag by extracting the Sigstore workflow-identity verification logic into a reusable script, adding regression coverage for identity-policy behavior, and updating documentation for the v1→v2 boundary and signed-tag release procedure.

Changes:

• Extracted Sigstore certificate identity verification into scripts/verify-release-identity.sh and invoked it from the composite action.
• Added a deterministic policy test harness (scripts/test-release-identity.sh) and a CI job to validate canonical, legacy, fork, override, and failure paths.
• Documented the v2 signed-tag release procedure (RELEASING.md) and repaired/expanded README inputs + v1→v2 guidance.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
scripts/verify-release-identity.sh	New reusable identity verification script with narrow legacy fallback only for the canonical repo.
scripts/test-release-identity.sh	Adds policy regression tests via a fake cosign to validate identity selection and fallback behavior.
RELEASING.md	Documents signed immutable v2.x.y + moving v2 tag procedure and post-merge steps.
README.md	Fixes inputs table layout and documents v1→v2 boundary + identity behavior.
action.yml	Replaces inline cosign identity verification with a call to the new script using github.action_path.
.github/workflows/test.yml	Adds a CI job to run the identity-policy regression test script.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.