Version Control for Deterministic Systems: Git Isn't Enough

How Merkle chains, cryptographic attestation, and reproducible builds satisfy certification evidence requirements