docs: Dashboards, config migration, container image sign

[knylander-grafana]

What this PR does:

Updates documentation for two new dashboards, a breaking config migration, an automated ring-cleanup behavior change, and container image signing/verification.

Original PRs documented:

• [Mixin] Add Service Topology dashboard #7207
• feat: add Tempo Livestore dashboard #7287
• Better trace by id sharding #7105
• distributor: auto-forget unhealthy ring entries #7098
• ci: sign and attest the main tempo image #7601
• ci: sign and attest tempo-query and tempo-cli images #7543
• ci: sign and attest tempo-vulture container images #7493

Which issue(s) this PR fixes:
Fixes #

Checklist

• Tests updated
• Documentation added
• Changelog entry added under .chloggen/ (run make chlog-new, or make chlog-new FILENAME=<name> to override the default branch-name file; see .chloggen/README.md)

[Copilot]

Pull request overview

Updates Tempo’s operational documentation to reflect Tempo 3.1-era behavior and observability additions, covering query/frontend behavior, querier metrics, ring self-healing, dashboards, and container image verification.

Changes:

• Document distributor ring auto-forget behavior and updated operational guidance in the mixin runbook.
• Add/adjust docs for Trace-by-ID sharding behavior, TraceQL metrics “span-only fetch” defaults/overrides, and a key querier backend-processing metric.
• Add a new guide for verifying signed Tempo container images and update monitoring docs for new dashboards.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
operations/tempo-mixin/runbook.md	Updates the TempoDistributorUnhealthy runbook to reflect auto-forget behavior and when manual “Forget” may still be needed.
docs/sources/tempo/set-up-for-tracing/setup-tempo/upgrade.md	Adds upgrade note describing Trace-by-ID sharding via blocks_per_shard and fallback behavior.
docs/sources/tempo/reference-tempo-architecture/components/querier.md	Documents the tempo_querier_backend_processing_duration_seconds metric and its intended use.
docs/sources/tempo/operations/verify-container-images.md	New page describing how to verify cosign signatures and SLSA provenance attestations for Tempo images.
docs/sources/tempo/operations/monitor/_index.md	Updates dashboard count and adds entries for Service Graph and Livestore dashboards.
docs/sources/tempo/metrics-from-traces/metrics-queries/_index.md	Updates TraceQL metrics query docs to describe the faster read path default and opt-out mechanisms.
docs/sources/tempo/configuration/_index.md	Updates override docs to reflect metrics_spanonly_fetch defaulting to enabled and how to opt out.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

docs/sources/tempo/operations/monitor/_index.md:55

• MEDIUM — The text/link here says the dashboards can be downloaded from operations/tempo-mixin/dashboards, but that directory contains Jsonnet sources (*.libsonnet) and is missing some of the referenced JSON outputs (for example tempo-livestore.json). The downloadable JSON dashboards live under operations/tempo-mixin-compiled/dashboards/ (10 files). Could we update this sentence/link to point at the compiled dashboards directory (or clarify that tempo-mixin is the source and the JSON comes from the compiled mixin)?

The [Tempo mixin](https://github.com/grafana/tempo/tree/main/operations/tempo-mixin) has ten Grafana dashboards in the `dashboards` folder that you can download and import into your Grafana UI.
These dashboards work well when you run Tempo in a Kubernetes (k8s) environment and metrics scraped have the

[mattdurham]

The section on signing looks good