feat: custom attestation summaries

[mbevc1]

Preflight

• I searched existing issues and didn't find a duplicate.

What problem are you trying to solve?

CLI support needed — what shape should the summary flag take?

The backend has added an optional summary to the custom attestation type definition. It's a top-level field in the data_json body of the create/update endpoint - a list of { name, expression } entries, e.g.:

"summary": [
  { "name": "Critical", "expression": ".critical_count" },
  { "name": "Tool", "expression": ".scanner.name" }
]

Because it lives inside that JSON blob (not the uploaded schema file), there's no user-facing way to set it until kosli create attestation-type grows a flag. It's additive and backward-compatible; types created without it fall back to the JQ pass/fail checklist.

Proposed solution

• Repeatable key=value — --summary "Critical=.critical_count" --summary "Tool=.scanner.name". Concise, but JQ expressions can contain = (assignment, == comparisons), so we'd need to split on the first = only and document that.
• Repeatable with an explicit separator / two flags — e.g. --summary-name/--summary-expression pairs, avoiding the = collision at the cost of verbosity.
• JSON passthrough — --summary-json '[{"name":...,"expression":...}]' or a --summary-file. Unambiguous and maps 1:1 to the API, but least ergonomic to type by hand.

Alternatives considered

I suggest starting with JSON field first and also adding repeatable --summary args, which should cover the use case for adding few simple ones.