Artifact attestation exists but the deploy gate verifies the wrong repository subject

Supply-chain verification is enabled, yet trusted artifacts are rejected because the admission or deploy gate expects a different repository identity than the builder actually signs.