fix(ci): attribute the Metal math headers to Netflix and sign tester bundles as .sigstore.json

[lusoris]

Summary

Master was red on two required checks of run set 37232274908 / 37232274888.

• Licence Provenance: seven core/src/feature/metal/metal_*_math.h headers (fix(metal): port the Metal twins to the exact designs of their CUDA, HIP and SYCL twins (ADR-1498) #1921, ADR-1498) were EUPL-1.2 alone although five reproduce Netflix code. Five now carry the dual tag of their CUDA/HIP/SYCL twins; two reproduce none and are [not_ports] entries with the reason; two need a [ports] entry because their names miss the family prefix.
• Scorecard Master Gate: aggregate 8.380952 against 8.5 (8.523810 at 4d3792b3). Two checks dropped. Signed-Releases: the tester prereleases count as releases and their cosign bundles were named <asset>.bundle, a suffix Scorecard v5.5.0 does not count; both tester workflows now write <asset>.sigstore.json. Binary-Artifacts: the committed eBPF object (cmd/vmafx-node/bpf/rclonebypass_bpfel.o) is deliberate (ADR-0779 / ADR-1539) and stays; recorded as an open maintainer decision.
• Affected suites venv isolation: run_affected_suites.py now prepends the suite venv's bin/ directory to PATH and sets VIRTUAL_ENV so subshells and hook tests execute inside the isolated suite environment, resolving test_framework_migration_preserves_legacy_and_native_stages.

Not fixed by a commit: the three tester prereleases already published stay unsigned in Scorecard's window until newer signed ones push them out. A maintainer can delete those disposable prereleases or sign their assets again.

Type of change

• fix — bug fix
• build / ci — tooling / infra

Checklist

• Commits follow Conventional Commits.
• If I touched any SIMD/GPU code path, I ran /cross-backend-diff — not applicable: licence header comments only, no code changed.
• If I added a new source file it has the appropriate licence header.
• I did not modify any assertAlmostEqual(...) score in the Netflix golden Python tests.

Deep-dive deliverables (ADR-0108)

• Research digest — no digest needed: trivial.
• Decision matrix — no alternatives: only-one-way fix (Scorecard's suffix list is fixed; each header's licence follows its provenance).
• AGENTS.md invariant note — no rebase-sensitive invariants beyond the rebase note.
• Reproducer / smoke-test command — below.
• CHANGELOG fragment — changelog.d/fixed/master-red-licence-scorecard-2026-10-05.md.
• Rebase note — docs/rebase-notes.md, "Metal helper-header licences and tester signature suffix".

docs/state.md

• docs/state.md updated: two closed rows and one open row (T-SCORECARD-COMMITTED-BPF-OBJECT-2026-10-05).

Reproducer

python3 scripts/dev/relicense_fork_files.py --check --upstream-ref $(python3 scripts/ci/upstream_parity_pin.py --within upstream/master)   # master: pending: 7; here: pending: 0
python3 scripts/ci/tests/test_tester_signature_extension.py   # fails on master's workflows, passes here