Bootstrapping Trust: From Isolated Build Machines to Enclaved CI Pipelines