feat(tyr): activate binary authorization policy and update docs

project/roadmap.md

@@ -9,7 +9,7 @@ This document tracks the high-level goals and future development milestones for
 ## Phase 1: TYR Service Identity (SPIFFE/SVID)
 - [x] Deploy step-ca
 - [x] Bootstrap SPIRE
-- [~] Establish Binary Authorization Infrastructure (staged, pending attestor creation)
+- [x] Establish Binary Authorization Infrastructure
 
 ## Phase 3: Memory Bank & Project Management
 - [x] Implement `read_memory_bank` and `write_memory_bank` MCP tools.

tyr/memory_bank/completed.md

@@ -9,5 +9,5 @@
   - Notes: `install_spire.sh` executed and daemons are running.
 
 - **Phase 1.4: Binary Authorization**
-  - Status: **Staged**
-  - Notes: Policy YAML drafted, but blocked on creation of a KMS-based attestor resource.
+  - Status: **Complete**
+  - Notes: KMS key, attestor, and policy are created and active.

tyr/policy/binauthz.yaml

@@ -5,14 +5,3 @@ defaultAdmissionRule:
     - projects/propane-will-491900-m5/attestors/tyr-kms-attestor
 globalPolicyEvaluationMode: ENABLE
 name: projects/propane-will-491900-m5/policy
-attestationAuthorities:
-  "projects/propane-will-491900-m5/attestors/tyr-kms-attestor":
-    userOwnedGrafeasNote:
-      noteReference: "projects/propane-will-491900-m5/notes/cosign-attestor-note" # NOTE: This is a placeholder
-      publicKeys:
-        - pkixPublicKey:
-            publicKeyPem: |-
-              -----BEGIN PUBLIC KEY-----
-              MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEk7BUor5+RImB5EiI7imet3Xwm4vj
-              j0Fg0sXKY8icZfinWr3hwyGwSGmd/vq22OLjIhlhChTp10xXzKIVZyzQAA==
-              -----END PUBLIC KEY-----