Image Signing and Verification

Use cosign or Notary to sign images and enforce signature verification at deployment time via admission controllers > 2. **Immutable Tags / Digest Pinning** — Reference images by SHA256 digest, not mutable tags > 3. **Private Base Images** — Maintain curated, scanned base images rather than pulling