Know exactly what's inside, prove exactly where it came from

Covers SBOM generation, artifact signing with cosign/Sigstore, and the SLSA supply-chain maturity framework.