feat(sign): attest only the platforms a release adds

netork's release joins an arm64 image to the amd64 one its dev build
already signed and attested, under a new index. ATTEST_PLATFORMS (the sign
action's attest-platforms) signs the new index and every platform behind
it, and attests only the ones named.

bin/sign.sh

@@ -10,7 +10,8 @@
 #
 # The platforms are whatever the reference holds (image_tools/platforms.py): an
 # index of amd64 and arm64, or one manifest. EXPECT_PLATFORMS ("amd64 arm64")
-# makes any other set an error.
+# makes any other set an error. ATTEST_PLATFORMS ("arm64") attests only those:
+# a release index joins arm64 to an amd64 image its dev build already attested.
 #
 # Nothing goes to a public transparency log: cosign-signing.json names none, so
 # the names in this registry stay inside. Everything is verified against
@@ -49,6 +50,7 @@ if [ -n "${EXPECT_PLATFORMS:-}" ]; then
 fi
 
 while read -r arch digest; do
+  case " ${ATTEST_PLATFORMS:-$arch} " in *" $arch "*) ;; *) echo "signed: $image@$digest ($arch)"; continue ;; esac
   for attestation in "$CIS_TYPE cis-$arch.json" "cyclonedx sbom-$arch.cdx.json"; do
     read -r type file <<<"$attestation"
     quietly cosign attest --yes --key env://COSIGN_PRIVATE_KEY --signing-config cosign-signing.json \