Attach a custom in-toto predicate as a cosign attestation and enforce it with a Rego admission policy

Steps

1. Produce a custom predicate JSON document (e.g. internal compliance-check output) that is not one of cosign's built-in predicate types.
2. Sign and attach it with cosign attest, setting the predicate file and type to custom, which wraps the predicate in an in-toto statement.
3. Write a Rego policy that inspects the predicate portion of the attestation for required fields, such as a passing compliance-check status.
4. Verify the attestation and evaluate the policy together with cosign verify-attestation, passing the Rego policy file and the custom type.
5. Wire the verify-attestation call into a deployment gate (CI job or admission controller) so images without a passing custom attestation are rejected before promotion.