opschain admin agent-release sign

packs:agentspacks:agent-governance

opschain admin agent-release sign --name <release> --version <semver> \
    --artifact <sha/digest> --manifest <file> --key-file <file> --out <signature file>

Signs a release payload locally with a keygen private key — no server call, so a build pipeline can sign offline. The signature covers the release identity (name + version), the artifact identity and the manifest digest; any post-signing change to any of them breaks verification. The base64 signature is written to --out (0600) and never printed; the output names the signing key by fingerprint.

Pass the signature file to create (its signature-file flag), or skip this verb and let create sign inline with the private key file.