Model the multi-arch index ↔ per-architecture child manifest relationship

[toddysm]

What

Introduces an ImageIndexObserved supply-chain-graph event kind that captures the multi-arch relationship between an image index (manifest list) and its per-platform child manifests, and indexes it as:

index -[:HAS_PLATFORM {os, architecture, variant, observedAt}]-> child

This closes the modeling gap where promote/build lineage points at the index digest while per-platform attestations attach to the child manifests, leaving referrer subjects disconnected from the rest of the graph.

Changes

• Schema — image-index-observed.schema.json + example (occurrence{registry,repository}, index{digest,tag?}, platforms[]{digest,os,architecture,variant?} minItems 1, observedAt).
• Graph model — new HAS_PLATFORM rel table in graph.py; _index_image_index_observed merges the index + each child occurrence and the platform edge.
• Queries — queries.platforms() (children of an index) and queries.index_of() (child → owning index) helpers.
• Producer — build-graph-event gains the ImageIndexObserved kind (new platforms argjson input); new stage-image-index-events composite action reads crane manifest and stages one event per multi-arch index. Wired into _mirror-image and the three promote workflows after copy/promote.
• Tests — indexer HAS_PLATFORM edge test, platforms()/index_of() query tests. 51 cssc_graph + 18 graph-service tests pass.
• Docs — observability event table updated.

Rolling per-platform referrers up to the index (so attestations surface on the image) is tracked separately in #217.

Fixes #216

[Copilot]

Pull request overview

Introduces a new ImageIndexObserved event and corresponding HAS_PLATFORM relationship in the supply-chain graph to model multi-arch image indices (manifest lists) and their per-platform child manifests, enabling graph queries to connect per-platform attestations/referrers back to the index lineage.

Changes:

• Adds an ImageIndexObserved JSON schema + example and updates docs to include the new event kind in relevant workflows.
• Extends graph storage/modeling with a HAS_PLATFORM rel table and indexer support to materialize index → child edges with platform metadata.
• Adds query helpers (platforms(), index_of()) plus unit tests, and wires a new composite action into mirror/promote workflows to stage the new events.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
supply-chain-graph/schema/image-index-observed.schema.json	New schema for ImageIndexObserved events (index ↔ child manifests + platform metadata).
supply-chain-graph/examples/image-index-observed.yaml	Example ImageIndexObserved record for local validation/indexing tests.
docs/architecture/observability/supply-chain-graph.md	Documents ImageIndexObserved as produced by mirror/promote workflows.
apps/python-app/libs/cssc_graph/cssc_graph/graph.py	Adds HAS_PLATFORM relationship table to the graph schema.
apps/python-app/libs/cssc_graph/cssc_graph/indexer.py	Indexes ImageIndexObserved events into HAS_PLATFORM edges.
apps/python-app/libs/cssc_graph/cssc_graph/queries.py	Adds platforms() and index_of() query helpers for index/child traversal.
apps/python-app/libs/cssc_graph/tests/test_indexer.py	Verifies ImageIndexObserved indexing creates HAS_PLATFORM edges.
apps/python-app/libs/cssc_graph/tests/test_queries.py	Adds tests for platforms() and index_of() query helpers.
.github/actions/stage-image-index-events/action.yml	New composite action to discover index children via crane manifest and stage ImageIndexObserved.
.github/actions/build-graph-event/action.yml	Adds support for building ImageIndexObserved event JSON records.
.github/workflows/_mirror-image.yml	Stages index→platform events after mirroring when a digest is resolved.
.github/workflows/_promote-from-quarantine.yml	Stages index→platform events after promotion.
.github/workflows/_promote-from-quarantine-sbom.yml	Stages index→platform events after promotion (SBOM variant).
.github/workflows/_promote-override.yml	Stages index→platform events after override promotion approval.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[toddysm]

Note: capture is wired into the acquire + catalog workflows. Wiring stage-image-index-events into the build/app-image workflows is tracked as a follow-up in #220 (app images have no referrers yet).