pub const LOCAL_PREFIX: &str = "attest-local/";Expand description
Where sign.sh --no-push keeps blocks that never reached origin, under
refs/notes/, prefixed to either ref name above. Origin cannot revoke
them, so a verifier reads them only when asked (--include-local).