feat: SDD post revisions + variant-pruning and witness draft posts

[avrabe]

Summary

• Revisions to the already-live SDD post (2026-04-23-spec-driven-development-is-half-the-loop):
  • Correct the sigil description — split "shipping today" (embedded WASM custom-section signing, Sigstore keyless with OIDC → Fulcio → Rekor, offline verification, in-toto SLSA L2/L3 provenance) from "in the pipe" (per-transformation attestation types upstream tools emit, post-quantum SLH-DSA, reproducibility work needed for SLSA L4)
  • Drop the overstated claim that sigil orchestrates cross-tool attestation — that composition lives in each tool and is ongoing work
  • Update two mermaid diagrams to mark the cross-layer attestation bundle as emerging (dashed) rather than shipped
  • Add the variant-pruning paragraph in the MBSE section that links forward to the next post
• Two new draft posts (both draft = true — will not render in production):
  • 2026-04-24-variant-pruning-rust-mcdc.md: the five-layer variant-pruning argument for why MC/DC on AI-authored Rust is tractable
  • 2026-04-25-witness-wasm-mcdc.md: announcement skeleton for the witness tool (tracked in Tool: witness — MC/DC for the WebAssembly component model (+ announcement post) #29)

WIP remains local as before (projects cube revamp, docs section, additional content sections).

Test plan

• zola build succeeds locally (21 pages, drafts correctly excluded)
• CI zola build passes on PR
• After merge: deploy succeeds (~1 min), live SDD post shows revised sigil language + updated diagrams
• Confirm drafts do NOT appear on /blog/ index on production

🤖 Generated with Claude Code