sigstore verification fails with readOnlyRootFilesystem - TUF cache cannot write to /.sigstore

[sampras343]

Description

The sigstore-go TUF client fails when the validation init container has readOnlyRootFilesystem: true (added in #178). The client attempts to mkdir /.sigstore to cache trust root metadata, which fails on a read-only filesystem.

Error

failed to create sigstore verifier: failed to load trust root: failed to fetch production trust root:
failed to create TUF client failed to create initial TUF updater: mkdir /.sigstore: read-only file system

Steps to Reproduce

1. Deploy the operator with the security hardening from add restricted SecurityContext to injected validation containers #178
2. Create a ModelValidation CR with sigstoreConfig
3. Create a pod with the validation.ml.sigstore.dev/ml label
4. The injected init container crashes with the above error

Expected Behavior

Sigstore verification should work with readOnlyRootFilesystem: true.

Root Cause

The restrictedSecurityContext() added in #178 sets ReadOnlyRootFilesystem: true, but the sigstore-go TUF client (sigstore-go@v1.1.4/pkg/tuf/options.go) defaults CachePath to $HOME/.sigstore/root and needs to write metadata there.

Fix

Inject an emptyDir volume at /.sigstore when sigstoreConfig is used. This provides a writable, ephemeral, pod-scoped mount point without compromising the read-only root filesystem.