A deploy pipeline signs the container image but not the values bundle that actually changes runtime behavior during a failover rehearsal

Supply-chain checks pass for the binary artifact while the configuration artifact remains unsigned and mutable. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.