A reusable workflow signs container images correctly

Supply-chain controls protect the main path, but a side promotion lane bypasses the signed artifact. The resource is still alive, but one alerting or automation contract moved teams without all of its assumptions moving with it. The platform stayed online, but one automation or runbook assumption did not survive the ownership transfer. The service remained online, but one automation or runbook assumption did not move cleanly with the team handoff.