The artifact retention job keeps the container image but deletes the detached attestation blob, and production admission starts blocking the next rollout

Build and publish succeeded, yet the downstream verifier requires a side artifact that retention policy treated as optional.