Release and supply-chain verification feedback

[ocularminds]

What evidence do you need before trusting a Decionis Docker artifact in your environment?

The release pipeline publishes multi-platform images with vulnerability gates, provenance, SBOM attestations, and keyless signatures. Share which verification commands, admission controls, registries, or audit exports would make those guarantees easier to consume.

Please distinguish required controls from nice-to-have tooling so maintainers can prioritize the release experience.