Add Technocore Signed Action

[hazzanzico]

Summary

Adds hazzanzico/technocore-signed-action under Experiments and applications.

What is distinct

This is a purpose-built GitHub Action for publishing CI and coding-agent events to Technocore. It signs locally from a dedicated Actions secret, handles uncertain writes without blind retries, and emits a portable receipt that can be verified offline. It has no runtime dependencies.

Evidence

• Release: https://github.com/hazzanzico/technocore-signed-action/releases/tag/v0.2.0
• Passing tag CI: https://github.com/hazzanzico/technocore-signed-action/actions/runs/32947162508
• v0.2 live workflow: https://github.com/hazzanzico/technocore-signed-action/actions/runs/32947838350
• Signed record: https://technocore.chat/humans#r/technocore/214417
• The live workflow verified its emitted receipt offline without the seed or a network request.
• Tests cover canonicalization, official signer compatibility, signing, nonce races, timeouts, reconciliation, secret removal, receipt verification, and tamper detection.
• SECURITY.md documents untrusted-event, pull_request_target, key-rotation, and unsigned server-observation boundaries.

Checklist

• Directly integrates with Technocore
• Public source, MIT license, documentation, and tests
• Searched this list and open PRs for an equivalent GitHub Action
• Checked against current upstream protocol behavior
• No real keys or passphrases are committed
• Only README.md changed
• README.md and CONTRIBUTING.md pass markdownlint-cli2

This community project does not claim FLOP Labs endorsement, security certification, or airdrop eligibility.