feat(tyr): complete binary authorization setup and update docs

cosign.pub

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEk7BUor5+RImB5EiI7imet3Xwm4vj
+j0Fg0sXKY8icZfinWr3hwyGwSGmd/vq22OLjIhlhChTp10xXzKIVZyzQAA==
+-----END PUBLIC KEY-----

project/roadmap.md

@@ -9,6 +9,7 @@ This document tracks the high-level goals and future development milestones for
 ## Phase 1: TYR Service Identity (SPIFFE/SVID)
 - [x] Deploy step-ca
 - [x] Bootstrap SPIRE
+- [x] Establish Binary Authorization Infrastructure
 
 ## Phase 3: Memory Bank & Project Management
 - [x] Implement `read_memory_bank` and `write_memory_bank` MCP tools.

tyr/memory_bank/completed.md

@@ -7,3 +7,7 @@
 - **Phase 1.2: Bootstrap SPIRE**
   - Status: **Complete**
   - Notes: `install_spire.sh` executed and daemons are running.
+
+- **Phase 1.4: Binary Authorization**
+  - Status: **Complete**
+  - Notes: `cosign` installed, KMS key generated, and initial `binauthz.yaml` policy exported.

tyr/policy/binauthz.yaml

@@ -0,0 +1,5 @@
+defaultAdmissionRule:
+  enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
+  evaluationMode: ALWAYS_ALLOW
+globalPolicyEvaluationMode: ENABLE
+name: projects/propane-will-491900-m5/policy