Add code signing policy

CODE_SIGNING_POLICY.md

@@ -0,0 +1,37 @@
+# Code Signing Policy
+
+NotAlterra uses automated, auditable pipelines to ensure every release
+artifact is traceable to its source.
+
+## Build & Signing Process
+
+All release binaries are built from this repository by GitHub Actions on
+tag push.  The CI workflow runs on `ubuntu-latest`, installs the
+required toolchain via `dtolnay/rust-toolchain@stable`, and produces
+deterministic artifacts using a locked `Cargo.lock` and pinned
+dependency versions.
+
+## AI Usage Disclosure
+
+This project uses agentic AI coding tools (e.g., DeepSeek TUI,
+GitHub Copilot) as assistive aides for code generation and review.  AI
+tools operate under human supervision only:
+
+- Every code change is reviewed and committed by a human maintainer.
+- AI-generated code is identified in commit history — no attempt is made
+  to obscure or anonymize the source.
+- All contributions pass the same lint and verification gates as any
+  human-authored change.
+
+## Integrity
+
+AI tools do not have direct write access to the release pipeline or the
+repository's tag namespace.  Builds are triggered exclusively by signed
+Git tags, which can only be created by a human maintainer with access to
+the project's GPG key.
+
+## Signing
+
+Only binaries produced by the official CI runner from the `master`
+branch will be submitted to SignPath for signing.  Manual or off-CI
+builds are never shipped as signed releases.