Document keeping the Rekor key and log across restarts

What does this MR do?

The prerequisites asked only for a persistent signing key, and the page never named the tree ID flag. Without it, Rekor starts a new, empty log on every restart while signing still passes. The new task sets both.

Rekor restart

sequenceDiagram
  accTitle: Rekor restart with a persistent signer
  accDescr: After a restart, Rekor signs with the same key. With a tree ID it reopens the existing log. Without one it creates a new, empty log and earlier entries are no longer returned.
  participant Job as cosign in a CI/CD job
  participant Rekor as rekor-server
  participant Signer as Signer, KMS or key file
  participant Trillian as Trillian log server
  Job->>Rekor: sign, entry recorded
  Note over Rekor: restart
  Rekor->>Signer: use the same key
  alt --trillian_log_server.tlog_id set
    Rekor->>Trillian: reopen the existing tree
    Job->>Rekor: sign, passes
    Note over Trillian: earlier entries still returned
  else tlog_id not set
    Rekor->>Trillian: create a new, empty tree
    Job->>Rekor: sign, passes
    Note over Trillian: earlier entries no longer returned<br/>new entries start at index 0
  end

On GitLab 19.4.1 with Rekor v1.5.4, both branches behaved as shown with a key file, and the tree ID branch also with a Vault transit key.

Related issues

Related to #419942. Follow-up to !231623 (merged).

Author's checklist

• Optional. Consider taking the GitLab Technical Writing Fundamentals course.
• Follow the:
  • Documentation process.
  • Documentation guidelines.
  • Style Guide.
• If you're adding a new page, add the product availability details under the H1 topic title.
• If you are a GitLab team member, request a review based on:
  • The documentation page's metadata.
  • The associated Technical Writer.

If you are a GitLab team member and only adding documentation, do not add any of the following labels:

• ~"frontend"
• ~"backend"
• ~"type::bug"
• ~"database"

These labels cause the MR to be added to code verification QA issues.

Reviewer's checklist

Documentation-related MRs should be reviewed by a Technical Writer for a non-blocking review, based on Documentation Guidelines and the Style Guide.

If you aren't sure which tech writer to ask, use roulette or ask in the #docs Slack channel.

• If the content requires it, ensure the information is reviewed by a subject matter expert.
• Technical writer review items:
  • Ensure docs metadata is present and up-to-date.
  • Ensure the appropriate labels are added to this MR.
  • Ensure a release milestone is set.
  • If relevant to this MR, ensure content topic type principles are in use, including:
    • The headings should be something you'd do a Google search for. Instead of Default behavior, say something like Default behavior when you close an issue.
    • The headings (other than the page title) should be active. Instead of Configuring GDK, say something like Configure GDK.
    • Any task steps should be written as a numbered list.
    • If the content still needs to be edited for topic types, you can create a follow-up issue with the docs-technical-debt label.
• Review by assigned maintainer, who can always request/require the reviews above. Maintainer's review can occur before or after a technical writer review.

An AI coding assistant wrote this change and this description. The assistant also ran each described behavior on a test VM running a GitLab 19.4.1 Linux package instance with a self-hosted Sigstore stack, checked each claim against those runs and the Rekor v1.5.4 source, and ran the project's Vale and markdownlint on the changed page.