Publish `ghcr.io/paperclipinc/chorus` signed with cosign keyless (OIDC) and carrying an SPDX SBOM attestation, per SECURITY.md. Acceptance: `cosign verify` pins the signer to the publish workflow and exits 0; the SBOM attestation verifies.
Publish
ghcr.io/paperclipinc/chorussigned with cosign keyless (OIDC) and carrying an SPDX SBOM attestation, per SECURITY.md.Acceptance:
cosign verifypins the signer to the publish workflow and exits 0; the SBOM attestation verifies.