trusted-workload-launcher: align reproducibility wording

Drop "reproducibly built" claims outside VERIFY.md. The release workflow
publishes a Sigstore build-provenance attestation that binds the image
digest to a specific GitHub workflow run / repo / ref / SHA; that is a
signed chain of custody, not a guarantee of bit-for-bit reproducibility.

Updated README.md trust-model diagram and verifier list, and the
examples/web-app.conf header.

Author: h4x3rotab

trusted-workload-launcher/README.md

@@ -47,9 +47,12 @@ pinned workload commit, see [`VERIFY.md`](./VERIFY.md).
 
 ```
 launcher image digest ──►  launcher implementation identity
-                           (this directory at commit L,
-                            reproducibly built; published by the release
-                            workflow with a Sigstore attestation)
+                           (this directory at commit L; the release
+                            workflow publishes a Sigstore build-provenance
+                            attestation that binds the image digest to a
+                            specific GitHub workflow run / repo / ref /
+                            SHA. This is a signed chain of custody, not a
+                            claim of bit-for-bit reproducibility.)
 
 launcher config file  ──►  workload pin
                            (REPO_URL + full COMMIT_SHA U; selects which
@@ -75,8 +78,11 @@ attestation:
 Once the config is attested by one of the first two options, a relying party
 verifies in four steps:
 
-1. The launcher image digest in the dstack attestation matches a reproducible
-   build of this directory at commit `L`.
+1. The launcher image digest in the dstack attestation matches the digest
+   published by the release workflow for this directory at commit `L`
+   (verified via the Sigstore build-provenance attestation, which binds
+   the digest to a specific GitHub Actions workflow run / repo / ref /
+   SHA — see [`VERIFY.md`](./VERIFY.md) for the exact check).
 2. The launcher script at commit `L` is the audited script — small, parses
    (does not source) its config, refuses anything but a full commit SHA, and
    verifies `HEAD` after checkout.

trusted-workload-launcher/examples/web-app.conf

@@ -5,15 +5,17 @@
 # to. The launcher refuses to start unless COMMIT_SHA is a full 40-hex SHA-1
 # or 64-hex SHA-256. Branches, tags, and short SHAs are rejected.
 #
-# REPO_URL must be the public canonical URL of the workload repository. When
-# the launcher image is built reproducibly, a verifier checks:
+# REPO_URL must be the public canonical URL of the workload repository.
+# A verifier checks:
 #
-#   image digest -> launcher repo at commit L
-#                -> this config file
-#                -> upstream workload repo at COMMIT_SHA
+#   image digest    -> launcher repo at commit L
+#                      (via the Sigstore build-provenance attestation
+#                       on the published image digest)
+#   attested config -> REPO_URL + COMMIT_SHA
+#                      (via dstack compose-hash, or a derived image digest)
+#   upstream repo   -> workload bytes at COMMIT_SHA
 #
-# so the launcher and its config together pin exactly which workload code
-# runs inside the dstack TEE.
+# Together these pin exactly which workload code runs inside the dstack TEE.
 
 REPO_URL=https://github.com/example-org/example-web-app.git
 COMMIT_SHA=0000000000000000000000000000000000000000