A reusable workflow signs container images correctly

Supply-chain controls protect the main path, but a side promotion lane bypasses the signed artifact. The workload kept its own settings, but the refreshed platform baseline now changes a lower layer assumption. The application itself changed little, but the refreshed baseline now interprets one dependency more strictly. The workload changed very little, but the new baseline now interprets one lower-layer dependency more aggressively. The workload barely changed, but the refreshed control plane now evaluates one supporting dependency more strictly than before.