feat(policies): add attestation phase lifecycle control to policy evaluation

Add an AttestationPhase enum (INIT, STATUS, PUSH) and an
attestation_phases field on PolicySpecV2 so policy authors can control
at which attestation lifecycle phase their policy is evaluated.

When no phases are specified the policy runs at all phases, preserving
backwards compatibility.

Closes #2764

Signed-off-by: Miguel Martinez <miguel@chainloop.dev>

Author: migmartri

app/cli/pkg/action/attestation_push.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -27,6 +27,7 @@ import (
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/renderer"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/signer"
+	"github.com/chainloop-dev/chainloop/pkg/policies"
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
 	protobundle "github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1"
 	"google.golang.org/grpc"
@@ -196,7 +197,7 @@ func (action *AttestationPush) Run(ctx context.Context, attestationID string, ru
 	}
 
 	// Add attestation-level policy evaluations
-	if err := crafter.EvaluateAttestationPolicies(ctx, attestationID, statement); err != nil {
+	if err := crafter.EvaluateAttestationPolicies(ctx, attestationID, statement, policies.EvalPhasePush); err != nil {
 		return nil, fmt.Errorf("evaluating attestation policies: %w", err)
 	}
 

app/cli/pkg/action/attestation_status.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -26,6 +26,7 @@ import (
 	v1 "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/renderer"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/renderer/chainloop"
+	"github.com/chainloop-dev/chainloop/pkg/policies"
 )
 
 type AttestationStatusOpts struct {
@@ -156,7 +157,7 @@ func (action *AttestationStatus) Run(ctx context.Context, attestationID string,
 		}
 
 		// Add attestation-level policy evaluations
-		if err := c.EvaluateAttestationPolicies(ctx, attestationID, statement); err != nil {
+		if err := c.EvaluateAttestationPolicies(ctx, attestationID, statement, policies.EvalPhaseStatus); err != nil {
 			return nil, fmt.Errorf("evaluating attestation policies: %w", err)
 		}