feat(ledger): Rekor v2 hashedrekord anchoring backend

[JSONbored]

Summary

Fourth sub-issue of #9267 (external ledger anchoring), stacked on #9271 (#9395). Primary anchoring mechanism per the mechanism research: hashedrekord is exactly built for a plain hash + signature — Rekor never sees the anchor payload itself. No Fulcio, no OIDC, no new dependency (ECDSA P-256/SHA-256 is native WebCrypto, the same keypair #9270 already produces for SignedLedgerAnchor).

• Shard URL is env-configurable (LOOPOVER_LEDGER_ANCHOR_REKOR_SHARD_URL) with a documented fallback, never hardcoded — per the research's explicit "shards roll annually, don't hardcode a log URL" warning.
• Every failure path — non-2xx response, an unparseable response body, a network exception — records status: 'failed' via ledger: anchor persistence + public attempt log (success and failure both visible) #9271's persistence rather than throwing past the caller, so ledger: git-commit anchoring backend, cross-verified against GH Archive / Software Heritage #9273's git backend still gets attempted even if Rekor is down.
• Storing the full TransparencyLogEntry (inclusion proof + signed checkpoint, for fully offline verification) is deliberately deferred — online verification via rekor-cli against the stored shard URL + uuid works completely without it today. Documented as an enhancement, not a gap.

A real bug caught and fixed during testing, not just a mock passing: this module was pre-stringifying its own error before handing it to recordLedgerAnchorAttempt, which then ran errorMessage() a second time on what was now a plain string — and errorMessage only extracts .message from actual Error instances, so every single failure path collapsed to the generic "unknown error" fallback regardless of what actually went wrong (a 429, a malformed response, a real network exception all looked identical on the public listing). Fixed by passing the raw unknown value through and teaching ledger-anchor-persistence.ts to handle both an already-built descriptive string and a genuine Error.

Closes #9272.

Test plan

• npx vitest run test/unit/ledger-anchor-rekor.test.ts — 9/9, 100% statement/branch/function/line coverage
• fetch is always injected — never a real network call to Rekor; the property under test is this module's own request/response/persistence logic
• Request shape verified against the real hashedRekordRequestV002 schema (digest, signature content, verifier public key + keyDetails)
• Response parsing handles Rekor's dynamic-uuid-keyed response shape and returns null (never throws) for 8 distinct malformed shapes
• All three failure paths proven to record a status: 'failed' row with the real error text (not the "unknown error" bug described above) and to resolve, never reject, past the caller
• Success path verified to record the full resolvable backendRef (shard URL + log index + key id + uuid)
• No regression: ledger-anchor-persistence.test.ts (8/8) and the two route test files (22/22) still green after the persistence-layer fix
• npx tsc --noEmit clean · npx tsx scripts/check-import-specifiers.ts clean

Base branch is feat/ledger-anchor-persistence (#9271, itself stacked on #9270) — merge order: #9392 → #9395 → this.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Important

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏳ LoopOver is waiting…

LoopOver has seen this pull request and is waiting on CI checks to finish before reviewing it. This comment will update once the review runs.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟨 Waiting}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.62%. Comparing base (0a93e29) to head (1c7a6b8).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9397      +/-   ##
==========================================
- Coverage   89.52%   88.62%   -0.90%     
==========================================
  Files         840      842       +2     
  Lines      109777   109835      +58     
  Branches    26147    26159      +12     
==========================================
- Hits        98275    97342     -933     
- Misses      10239    11521    +1282     
+ Partials     1263      972     -291     

Flag	Coverage Δ
backend	93.59% <100.00%> (-1.65%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/review/ledger-anchor-git.ts	100.00% <100.00%> (ø)
src/review/ledger-anchor-persistence.ts	100.00% <100.00%> (ø)
src/review/ledger-anchor-rekor.ts	100.00% <100.00%> (ø)
src/review/ledger-anchor.ts	100.00% <ø> (ø)

... and 3 files with indirect coverage changes

[codecov]

Bundle Report

Bundle size has no change ✅