Graph evidence: typed SBOM/provenance/vuln/signature relationships + verification state

[toddysm]

Part of #168 (gap analysis bucket 3b: evidence/detail).

Problem

Attestations, SBOMs, signatures, and scan results are currently represented only as generic REFERS_TO referrers keyed by artifactType. #168 requires typed relationships and richer detail: signatures, signer identities, verification state and evidence, and typed links to SBOM/provenance/vulnerability reports.

Scope

• Introduce typed relationships (or typed referrer roles) for SBOM, provenance, vulnerability report, and signature.
• Model signer identity, signature verification state, and signature evidence.
• Expose these in show (CLI + graph-service) and the visualization payloads.

Acceptance criteria

• Typed evidence relationships modeled and indexed.
• show returns signer/verification state and typed evidence links.
• Tests + docs updated.