Harden cross-checker installation with immutable versions and verified archives #33

Audit finding

The crosscheck-matrix job is otherwise read-only and pins GitHub Actions by full commit SHA, but its external tool bootstrap is not reproducible:

• go install github.com/joncrlsn/pgdiff@latest
• go install github.com/stripe/pg-schema-diff/cmd/pg-schema-diff@latest
• curl -sSf https://atlasgo.sh | sh
• Liquibase and Flyway archives are downloaded and extracted without a published checksum check
• pipx install migra and injected Python packages are not version locked
• the developer helper scripts/install-crosscheckers.sh repeats the mutable Go/Python/Homebrew resolution

This permits upstream releases or installer content to change without a repository review and makes a previously green migration certificate difficult to reproduce.

Required remediation

• Record exact versions or source commit SHAs for all seven cross-checkers in one machine-readable lock file.
• Install Go tools at explicit module versions; do not use @latest.
• Replace the Atlas remote installer pipe with a versioned archive/package and verify its SHA-256 digest.
• Verify Liquibase and Flyway archive hashes before extraction.
• Pin Migra, setuptools compatibility, and the PostgreSQL driver versions.
• Make scripts/install-crosscheckers.sh consume the same lock file as CI.
• Emit tool versions and lock-file digest into the cross-check evidence.
• Add a policy test rejecting @latest, remote curl | sh, and unchecked downloaded archives in required CI.
• Keep missing optional local tools explicit; do not report skipped tools as successful countersignatures.

Acceptance evidence

A fresh runner at an exact repository commit installs the same tool identities, verifies every downloaded artifact, prints the lock digest and tool versions, and completes the seven-tool matrix. The aggregate declmig-e2e evidence bundle records those identities before production promotion.

This issue is intentionally separate from the aggregate E2E bootstrap so the new promotion contract does not falsely claim the current cross-checker supply chain is already closed.