container signing

Cosign + SBOM in CI: Sign and Attest a Container Image in One Workflow

One CI shape: build an image by digest, Syft SBOM, Cosign sign + SBOM attest, verify success, and prove wrong-key/unsigned failure — the operational follow-on to after-xz.