SLSA AF.2: Produce verification summary attestations correctly

What does AF.2 require?

A verification summary attestation (VSA, predicate https://slsa.dev/verification_summary/v1) states that a verifier checked artifacts against a policy. It must identify the verifier (a URI reflecting the trust base consumers care about; consumers must accept only specific signer and verifier pairings), give the resourceUri from which the consumer is expected to fetch the artifact (or tell consumers the expected value another way), identify the policy by URI and preferably digest, list every input attestation if that field is used (each with a digest), report PASSED or FAILED, and give in verifiedLevels only the highest level per track plus any verified properties (or FAILED). dependencyLevels, if given, counts each transitive dependency once per track at its highest level (an empty object means no dependencies, an absent one means no claim). Custom level values must not start with SLSA_; consumers must ignore unrecognised fields. A VSA lets consumers rely on the verifier without seeing every attestation, and lets producers keep pipeline details confidential.