spec §2 reference signing workflow signs the checkout, not the packaged payload

spec-attestation-and-crl-workflows.md §2 step 3 has the reference developer
signing workflow run:

ocsign --path . --key <secret> --cert leaf.crt --chain intermediate.crt

In a GitHub Actions job . is the actions/checkout tree. In app mode the
manifest hashes everything under --path bar appinfo/signature.json and OS
cruft, so that command signs .git, tests/, .github/ and any build scratch
as part of the app — and the resulting signature.json verifies, because it
genuinely describes the tree that was signed.

This is not hypothetical: it is what shipped as
files_antivirus v1.3.1,
whose release archive carried the whole checkout with a manifest covering 537
paths including .git/config and .git/index.

owncloud/ocsign#21 makes ocsign refuse a --path that holds a .git entry,
so the workflow as specified now exits 1.

Fix: §2 should package the app payload first and point --path at the staging
directory (e.g. build/artifacts/appstore/<app>), signing before the tarball is
rolled. The step order in §2 currently signs (step 3) and packages (step 5) —
step 5 must produce the tarball from the tree that step 3 signed, which is the
payload, not the repo root. The full YAML in the developer-documentation spec
needs the same correction.

Open spec-attestation-and-crl-workflows.md and inspect §2 steps 3 and 5, including the full YAML. Update the workflow so packaging creates the staging payload before signing, and the tarball is built from the same signed tree rather than the checkout root. Done means the documented workflow signs the packaged payload without including .git or other checkout files.