Usage: rebar remote-cert <ticket-id> {completion-verifier|plan-review} [--root <path>]

Request a trusted-environment op-cert with `rebar remote-cert <ticket-id>
<kind>`. Routes a gate run to the trusted op-cert service at
`verify.opcert_remote_url`. It signs the request with SigV4 using ambient AWS
credentials, submits the asynchronous job, polls until a terminal status, and on
a `PASS` verdict persists the returned envelope and its bound fields as a
`SIGNATURE` event. That event uses the same record shape that
`signing.sign_opcert_manifest` appends, and it auto-pushes with the tickets
branch. The result is safe because the envelope is self-authenticating, so
tampering with a bound value breaks the signature that the merge gate `rebar
verify-opcert` verifies. A non-PASS or error verdict exits non-zero. The remote
path is entirely opt-in. When `verify.opcert_remote_url` is unset the command
reports a clear error, and no local op-cert sign or verify path ever depends on
it.

positional arguments:
  ticket_id             the ticket to certify
  {completion-verifier,plan-review}
                        the gate kind to run

options:
  -h, --help            show this help message and exit
  --root ROOT           repo root (default: cwd)
