sigmashake-canary — supply-chain integrity canary.
See https://docs.sigmashake.com/security for the manifest format.
GET /.well-known/canary-pubkey to fetch the active signing pubkey.
GET /api/v1/verify/:registry/:package/:version[/:filename] for a manifest row.
GET /api/v1/stats for aggregate registry + drift counts.