Nostr and github are both fine for me. For proof metadata I would just add the relevant tags as you say (`r`, or whatever). But at that point you're kind of stepping outside NIP 32's scope. I'd probably try to keep things focused by using a different kind for attestations like that.